Wordpress Shortcodes Plugin — Shortcodes Ultimate
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wordpress_shortcodes_plugin_—_shortcodes_ultimate:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wordpress Shortcodes Plugin — Shortcodes Ultimate (d95bced9-ce35-5e56-ac56-f2794fffbfd0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-0911 |
vulnerable | 2026-06-08 05:52:33.441349 |
Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
Published: 2023-03-20T15:52:23.686Z
Updated: 2025-02-25T20:28:41.019Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0890 |
vulnerable | 2026-06-08 05:52:33.389044 |
Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
Published: 2023-03-20T15:52:16.009Z
Updated: 2025-02-26T14:32:01.811Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24525 |
vulnerable | 2026-06-08 05:30:04.522729 |
Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
Published: 2021-09-20T10:06:15.000Z
Updated: 2024-08-03T19:35:19.902Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.