EUVD-2026-18977
GHSA-xrr8-pmp3-3j6q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.8 allows authenticated attackers with author-level permissions to inject arbitrary JavaScript into pages via the su_carousel shortcode's 'su_slide_link' attachment meta field. The vulnerability stems from insufficient input sanitization and output escaping, enabling malicious scripts to execute when any user visits an affected page. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability exists in the su_carousel shortcode handler within the Shortcodes Ultimate WordPress plugin (CPE: cpe:2.3:a:gn_themes:wp_shortcodes_plugin_-_shortcodes_ultimate:*:*:*:*:*:*:*:*). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting). The 'su_slide_link' parameter, which stores attachment metadata associated with carousel slides, is processed without adequate sanitization before storage and without proper HTML entity encoding before output. This allows an authenticated user to craft a shortcode with JavaScript payload in the su_slide_link field, which is then persistently stored in the WordPress database and executed in the browsers of subsequent visitors. The attack requires author-level or higher privileges, suggesting the attacker must have legitimate WordPress editorial access or the ability to compromise an author account.
RemediationAI
Update the WP Shortcodes Plugin - Shortcodes Ultimate to version 7.4.9 or later, which contains fixes to the carousel.php shortcode handler addressing input sanitization and output escaping of the su_slide_link field. Site administrators should access the WordPress Plugins dashboard, locate 'Shortcodes Ultimate', and apply the available update immediately. Until patching is possible, limit author-level access to trusted users only and regularly audit carousel shortcodes in published posts and pages for suspicious 'su_slide_link' values. Further details on the vulnerability and patch status are available from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=cve) and CleanTalk research (https://research.cleantalk.org/cve-2026-0738/).
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.9 allows authenticat
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.7 allows authenticated
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today