Advisories · Technology
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate.
Every CVE that names gn_themes WP Shortcodes Plugin — Shortcodes Ultimate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site request forgery (CSRF)
- CVSS 6.4 Medium
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- Broken access control