Unknown WP Shortcodes Plugin — Shortcodes Ultimate vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown WP Shortcodes Plugin — Shortcodes Ultimate, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2024-2583getshortcodesshortcodes_ultimate+2
EPSS score
0.40%
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.6.4CVE-2024-3188getshortcodesshortcodes_ultimate+2
EPSS score
0.44%
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks6.4CVE-2024-3548getshortcodesshortcodes_ultimate+2
EPSS score
0.44%
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin