CVE-2024-4553

CVE-2024-4553 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress, affecting all versions up to and including 7.1.5. This flaw stems from insufficient input sanitization and output escaping of the 'color' attribute within the 'su_members' shortcode. Authenticated attackers with contributor-level access or higher can inject malicious web scripts that execute when a user views an affected page. The vulnerability is rated Medium severity with a CVSS score of 5.4, indicating a network-based attack with low privileges, requiring user interaction, and leading to low impact on confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 23/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are also minimal, aligning with typical trends for the majority of vulnerabilities.