What’s Vulnerable › Products

gn_themes WP Shortcodes Plugin — Shortcodes Ultimate vulnerabilities

34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your gn_themes WP Shortcodes Plugin — Shortcodes Ultimate version is affected

Latest gn_themes WP Shortcodes Plugin — Shortcodes Ultimate vulnerabilities

• CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
• CVE-2026-0738 — Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode (CVSS 6.4)
• CVE-2026-0737 — Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode (CVSS 6.4)
• CVE-2026-2480 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute (CVSS 6.4)
• CVE-2025-12800 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 6.4)
• CVE-2025-8015 — Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link (CVSS 6.4)
• CVE-2025-7369 — Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution (CVSS 6.1)
• CVE-2025-7354 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes (CVSS 6.4)
• CVE-2025-5567 — Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute (CVSS 5.4)
• CVE-2024-8500 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-6766 — Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2024-4217 — Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS (CVSS 4.7)
• CVE-2024-4821 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode (CVSS 5.4)
• CVE-2024-4553 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode (CVSS 5.4)
• CVE-2023-25050 — WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerability (CVSS 7.1)
• CVE-2024-3548 — Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS (CVSS 6.1)
• CVE-2024-3550 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2024-3188 — Shortcodes Ultimate < 7.1.0 - Contributor+ Stored XSS (CVSS 6.3)
• CVE-2024-2583 — Shortcodes Ultimate < 7.0.5 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2024-0792 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 5.4)
• CVE-2024-1808 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode (CVSS 5.4)
• CVE-2024-1510 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode (CVSS 5.4)
• CVE-2023-6488 — WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2023-6226 — WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure (CVSS 4.3)
• CVE-2023-6225 — WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)