Skip to content
Sign in
6.3 Medium

CVE-2024-3188 The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its…

Description

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected products and versions

Product Affected versions Fixed in
shortcodes_ultimate 7.1 earliest → < 7.1.0 7.1.0
WP Shortcodes Plugin — Shortcodes Ultimate 7.1 earliest → < 7.1.0 7.1.0

Other CVEs of shortcodes_ultimate

The 3 CVEs of shortcodes_ultimate →
CVE-2024-4217 The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings,… 4.7 Medium CVE-2024-2583 The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its… 5.4 Medium
Track this CVE