EUVD-2026-17691
GHSA-23f4-hfmq-94mj
GHSA-2xjq-x834-qrr3
GHSA-43mh-3pgg-2xjc
GHSA-8623-9fwr-4cxv
GHSA-v546-jrfg-ph8q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the su_box shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.10 allows authenticated contributors and above to inject arbitrary JavaScript via the 'max_width' attribute of the su_box shortcode due to insufficient input sanitization and output escaping. The injected scripts persist in page content and execute for all users viewing the affected page, enabling attackers with contributor-level WordPress access to compromise site visitors without additional user interaction.
Technical ContextAI
The vulnerability exists in the su_box shortcode handler (located in includes/shortcodes/box.php) which processes the 'max_width' attribute without proper sanitization before rendering it into HTML output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied shortcode attributes are directly interpolated into CSS or HTML context without escaping. The vulnerability affects the WP Shortcodes Plugin - Shortcodes Ultimate plugin (CPE references WordPress plugin ecosystem), which provides extensible shortcode functionality for WordPress sites. Because the shortcode content is stored in the WordPress post/page database and rendered server-side, any authenticated user with contributor access or higher can create or modify posts containing the malicious shortcode, and the XSS payload will execute persistently for all visitors.
RemediationAI
The primary remediation is to upgrade WP Shortcodes Plugin - Shortcodes Ultimate to version 7.4.11 or later, which includes fixes to properly sanitize and escape the 'max_width' attribute and other shortcode parameters. The fix is documented in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate/trunk/includes/shortcodes/box.php. Site administrators should immediately update the plugin through the WordPress admin dashboard (Plugins > Installed Plugins > Shortcodes Ultimate > Update). As a temporary workaround pending patching, restrict the contributor role to trusted users only via WordPress role management, or temporarily disable the Shortcodes Ultimate plugin if it is not actively required. For detailed vulnerability information and confirmation of patch availability, refer to the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/61ab7a28-bcca-41ff-89d1-c083c6b0d39f?source=cve.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today