# gn_themes WP Shortcodes Plugin — Shortcodes Ultimate.

Every CVE that names gn_themes WP Shortcodes Plugin — Shortcodes Ultimate among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode](https://agentprime.io/advisories/CVE-2026-0737.md)
  `CVE-2026-0737` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode](https://agentprime.io/advisories/CVE-2026-0738.md)
  `CVE-2026-0738` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-2480.md)
  `CVE-2026-2480` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12800.md)
  `CVE-2025-12800` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 23 Nov 2025 · Tags: Server-side request forgery (SSRF)
- [Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link](https://agentprime.io/advisories/CVE-2025-8015.md)
  `CVE-2025-8015` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes](https://agentprime.io/advisories/CVE-2025-7354.md)
  `CVE-2025-7354` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-7369.md)
  `CVE-2025-7369` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.1 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Cross-site request forgery (CSRF)
- [Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute](https://agentprime.io/advisories/CVE-2025-5567.md)
  `CVE-2025-5567` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter](https://agentprime.io/advisories/CVE-2025-0370.md)
  `CVE-2025-0370` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · EPSS 0.37 · Not analysed yet · Published 4 Mar 2025 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-8500.md)
  `CVE-2024-8500` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode](https://agentprime.io/advisories/CVE-2024-4821.md)
  `CVE-2024-4821` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode](https://agentprime.io/advisories/CVE-2024-4553.md)
  `CVE-2024-4553` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 21 May 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2024-3550.md)
  `CVE-2024-3550` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode](https://agentprime.io/advisories/CVE-2024-1808.md)
  `CVE-2024-1808` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode](https://agentprime.io/advisories/CVE-2024-0792.md)
  `CVE-2024-0792` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode](https://agentprime.io/advisories/CVE-2024-1510.md)
  `CVE-2024-1510` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2023-6488.md)
  `CVE-2023-6488` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 5.4 Medium · Not analysed yet · Published 19 Dec 2023 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2023-6225.md)
  `CVE-2023-6225` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 6.4 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: Cross-site scripting (XSS)
- [WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure](https://agentprime.io/advisories/CVE-2023-6226.md)
  `CVE-2023-6226` · CVE record: gn_themes WP Shortcodes Plugin — Shortcodes Ultimate · CVSS 4.3 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gn-themes-wp-shortcodes-plugin-shortcodes-ultimate>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gn-themes-wp-shortcodes-plugin-shortcodes-ultimate/>. Everything for agents: <https://agentprime.io/llms.txt>.