Shortcodes Ultimate
Vendor:
First CVE: Jul 7, 2017 · Active for 9 years
25
Total CVEs
More Total CVEs than 95% of tracked products
3.6
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
5.8
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Shortcodes Ultimate over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 7, 2017
9 years ago
Most Recent CVE
Jul 4, 2025
385 days ago
CVE Severity & Scoring
Shortcodes Ultimate25 CVEs
92%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network25 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low25 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (24.0%)
Unknown0 (0.0%)
Required19 (76.0%)
Privileges Required
Low19 (76.0%)
High0 (0.0%)
None6 (24.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-18580CRITICAL The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. | Aug 22, 2019 | 9.8 | 44 | NO | YES |
CVE-2022-41136HIGH Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress. | Nov 8, 2022 | 8.8 | 27 | NO | NO |
CVE-2023-0911MEDIUM The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authentica | Mar 20, 2023 | 6.5 | 21 | NO | NO |
CVE-2023-0890MEDIUM The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be ac | Mar 20, 2023 | 6.5 | 21 | NO | NO |
CVE-2023-25040MEDIUM Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions. | Mar 30, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-23800MEDIUM Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue affects WP Shortcodes Plugin — Shortcodes Ultimate: from n/a | Nov 13, 2023 | 6.5 | 19 | NO | NO |
CVE-2021-24525MEDIUM The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its h | Sep 20, 2021 | 5.4 | 19 | NO | NO |
CVE-2025-5567MEDIUM The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and | Jul 4, 2025 | 5.4 | 18 | NO | NO |
CVE-2024-6766MEDIUM The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortco | Aug 6, 2024 | 5.4 | 18 | NO | NO |
CVE-2024-4553MEDIUM The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and | May 21, 2024 | 5.4 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (25 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
4.0% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (25 CVEs).
Media Mentions
Signals from CVEs in this product scope (25 CVEs).
Top CNAs Publishing CVEs For Shortcodes Ultimate
Top CWEs
Versions
No cataloged versions.