The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/ | Exploit Third Party Advisory |
Configurations
History
12 May 2025, 19:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| First Time |
Getshortcodes shortcodes Ultimate
Getshortcodes |
|
| References | () https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:* |
13 Apr 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-13 05:15
Updated : 2025-05-12 19:41
NVD link : CVE-2024-2583
Mitre link : CVE-2024-2583
JSON object : View
Products Affected
getshortcodes
- shortcodes_ultimate
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')