Shortcodes Ultimate < 7.4.3 - Arbitrary Shortcode Execution via CSRF

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.