Stored Cross-Site Scripting in Shortcodes Ultimate Plugin for WordPress
CVE-2026-2480

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
WP Shortcodes Plugin — Shortcodes Ultimate
Vendor
CVE Published:
31 March 2026

What is CVE-2026-2480?

The Shortcodes Ultimate plugin for WordPress is compromised by a Stored Cross-Site Scripting vulnerability due to inadequate sanitization and escaping of user-supplied attributes within the 'max_width' parameter of the su_box shortcode. This flaw allows authenticated attackers with contributor-level access or higher to execute arbitrary scripts in web pages, posing a risk to all users who access the altered content. This vulnerability is present in all versions up to and including 7.4.10, highlighting the critical need for timely updates and security best practices.

Affected Version(s)

WP Shortcodes Plugin — Shortcodes Ultimate 0 <= 7.4.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/shortcodes-ult...
https://plugins.trac.wordpress.org/browser/shortcodes-ult...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Iden
.