WordPress Plugin Vulnerabilities

Shortcodes Ultimate < 7.4.3 - Author+ Stored XSS via Image Title and Slide Link

Description

The plugin is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
shortcodes-ultimate
Fixed in 7.4.3

References

CVE
CVE-2025-8015
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/deba0a29-7fe5-4f94-bee6-9d01e023215e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Verified
No
WPVDB ID
f6c79179-cf19-4759-adf0-77b1062578a2

Timeline

Publicly Published
2025-07-21 (about 9 months ago)
Added
2025-07-22 (about 9 months ago)
Last Updated
2025-07-22 (about 9 months ago)

Other

Published
Title
Published
2025-04-09
Title
Oppso Unit Converter <= 1.1.1 - Reflected Cross-Site Scripting
Published
2023-11-28
Title
Accelerated Mobile Pages < 1.0.89 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Published
2014-08-01
Title
Zopim Live Chat <= 1.2.5 - XSS in ZeroClipboard
Published
2024-04-10
Title
F4 Improvements < 1.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2025-10-10
Title
Open Currency Converter <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting