Stored Cross-Site Scripting in Shortcodes Ultimate Plugin for WordPress

CVE-2026-2480

What is CVE-2026-2480?

The Shortcodes Ultimate plugin for WordPress is compromised by a Stored Cross-Site Scripting vulnerability due to inadequate sanitization and escaping of user-supplied attributes within the 'max_width' parameter of the su_box shortcode. This flaw allows authenticated attackers with contributor-level access or higher to execute arbitrary scripts in web pages, posing a risk to all users who access the altered content. This vulnerability is present in all versions up to and including 7.4.10, highlighting the critical need for timely updates and security best practices.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References