Unknown Wordpress Shortcodes Plugin — Shortcodes Ultimate vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Wordpress Shortcodes Plugin — Shortcodes Ultimate, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4CVE-2021-24525getshortcodesshortcodes_ultimate+2
EPSS score
0.62%
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).6.5CVE-2023-0890getshortcodesshortcodes_ultimate+2
EPSS score
0.65%
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts6.5CVE-2023-0911getshortcodesshortcodes_ultimate+2
EPSS score
0.65%
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.