CVE-2021-24525: Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-20 · updated 2026-06-17
Weakness: CWE-79

Description

The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).

Affected products

gn_themes WP Shortcodes Plugin — Shortcodes Ultimate: before 5.10.2 — fixed in 5.10.2

How to fix

Upgrade to a fixed version: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate 5.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24525 or the next vulnerability affects your stack