EUVD-2026-23159
GHSA-99qg-46r6-v9px
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
4DescriptionCVE.org
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.9 allows authenticated contributors and above to inject arbitrary JavaScript into WordPress pages via the 'su_box' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users who access the affected pages, potentially compromising site visitors' sessions and data. No public exploit code has been identified at the time of analysis, though the vulnerability is straightforward to reproduce and weaponize.
Technical ContextAI
The vulnerability exists in the su_box shortcode handler, which processes user-supplied shortcode attributes without properly sanitizing input or escaping output when rendering HTML. The WP Shortcodes Plugin - Shortcodes Ultimate (CPE: cpe:2.3:a:gn_themes:wp_shortcodes_plugin_-_shortcodes_ultimate) is a WordPress plugin that provides content creation shortcodes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web vulnerability class where user-controlled data is embedded directly into HTML output without encoding special characters. In WordPress context, this means shortcode attributes passed by authenticated users are rendered as-is into page markup, allowing attackers to break out of attribute contexts and inject script tags or event handlers. The shortcode processing occurs server-side, but the malicious payload is stored in the WordPress database and delivered to all subsequent page visitors, making this a stored XSS rather than reflected.
RemediationAI
The primary remediation is to upgrade the WP Shortcodes Plugin - Shortcodes Ultimate to a patched version released after 7.4.9. A fix has been released as indicated by the WordPress plugin changeset reference (https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate); users should update to the latest version available in the WordPress plugin repository. If immediate patching is not possible, mitigate the risk by restricting contributor-level access to only trusted staff members and regularly audit existing posts/pages for suspicious shortcode usage, particularly the su_box shortcode with unusual attributes. Additionally, consider disabling the su_box shortcode if it is not actively used by implementing a custom filter in your theme's functions.php to remove the shortcode. Monitor user activity logs and review recent post revisions for unexpected changes to su_box usage. These compensating controls reduce but do not eliminate risk, so patching should be prioritized.
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.7 allows authenticated
Stored Cross-Site Scripting in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.8 allows authenticated attac
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today