Extension WordPress
Vulnérabilités Shortcodes Ultimate – Content Elements, page 2
Cette page rassemble les failles publiées pour Shortcodes Ultimate – Content Elements, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Shortcodes Ultimate – Content Elements
39 fiches
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on…
*-7.0.3
7.0.4
27/02/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on…
*-7.0.2
7.0.3
19/02/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.0.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS…
*-7.0.1
7.0.2
07/02/2024
WP Shortcodes Plugin , Shortcodes Ultimate <= 7.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and…
*-7.0.0
7.0.1
18/12/2023
WP Shortcodes Plugin , Shortcodes Ultimate <= 5.13.3 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input…
*-5.13.3
7.0.0
27/11/2023
WP Shortcodes Plugin , Shortcodes Ultimate <= 5.13.3 – Insecure Direct Object Reference to Information Disclosure
The WP Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys…
*-5.13.3
7.0.0
27/11/2023
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
5.12.5-5.13.0
5.13.1
18/07/2023
Shortcodes Ultimate <= 5.12.7 – Authenticated (Subscriber+) Arbitrary Post Access via Shortcode
The Shortcodes Ultimate plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization controls in a plugin's shortcode in versions up to, and including, 5.12.7. This makes it possible for authenticated attackers with subscriber-level…
*-5.12.7
5.12.8
27/02/2023
Shortcodes Ultimate <= 5.12.7 – Authenticated (Subscriber+) Information Exposure
The Shortcodes Ultimate for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.12.7 via its shortcodes. This can allow authenticated attackers with subscriber-level privileges or higher to extract sensitive data including user meta…
*-5.12.7
5.12.8
27/02/2023
Shortcodes Ultimate <= 5.12.6 – Authenticated (Contributor+) Stored Cross Site Scripting
The Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.12.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
*-5.12.6
5.12.7
10/02/2023
Shortcodes Ultimate <= 5.12.6 – Authenticated (Subscriber+) Server-Side Request Forgery
The Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 5.12.6. This is due to insufficient validation on the url being supplied via the "url" attribute of the su_csv_table shortcode.…
*-5.12.6
5.12.7
10/02/2023
Shortcodes Ultimate <= 5.12.6 – Authenticated (Subscriber+) Arbitrary File Read via Shortcode
The Shortcodes Ultimate plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 5.12.6. This is due to insufficient validation on the url being supplied via the "url" attribute of the su_table shortcode.…
*-5.12.6
5.12.7
10/02/2023
Shortcodes Ultimate <= 5.12.0 – Cross-Site Request Forgery
The Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.12.0. This is due to missing nonce validation on the ajax_add_preset() function. This makes it possible for unauthenticated attackers to…
*-5.12.0
5.12.1
13/10/2022
Shortcodes Ultimate <= 5.12.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘settings’ parameter saved via the ajax_add_preset() function in versions up to, and including, 5.12.0 due to insufficient input sanitization and output escaping. This makes…
*-5.12.0
5.12.1
13/10/2022
Shortcodes Ultimate <= 5.12.0 – Cross-Site Request Forgery
The Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.12.0. This is due to missing or incorrect nonce validation on the ajax_remove_preset() and ajax_get_preset() functions. This makes it possible…
*-5.12.0
5.12.1
02/10/2022
WordPress Shortcodes Plugin , Shortcodes Ultimate <= 5.10.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are…
[*, 5.10.2)
5.10.2
23/08/2021
WordPress Shortcodes Plugin , Shortcodes Ultimate <= 5.0.0 – Authenticated Remote Code Execution
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
[*, 5.0.1)
5.0.1
31/10/2017
WordPress Shortcodes Plugin , Shortcodes Ultimate < 4.10.0 – Directory Traversal
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors.
[*, 4.10.0)
4.10.0
23/06/2017
WordPress Shortcodes Plugin , Shortcodes Ultimate <= 4.9.3 – Cross-Site Scripting
The WordPress Shortcodes Plugin , Shortcodes Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘code’ parameter in versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it…
*-4.9.3
4.9.4
05/05/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.