Plugin security history

Shortcodes Ultimate – Content Elements Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 39 vulnerability records associated with Shortcodes Ultimate – Content Elements, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

39Total records

0Critical

3High

36Medium

0Low

0Informational

39Patched records

0Currently marked unpatched

2015-05-05First disclosure

2026-04-30Latest disclosure

37 of 39CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2017	2	2 records
2021	1	1 records
2022	3	3 records
2023	9	9 records
2024	10	10 records
2025	8	8 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
High	3	7.7%
Medium	36	92.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

28 records71.8%

First: 2015. Latest: 2026.

Other

3 records7.7%

First: 2017. Latest: 2025.

CSRF

3 records7.7%

First: 2022. Latest: 2025.

Path Traversal

2 records5.1%

First: 2017. Latest: 2023.

Missing Authorization

2 records5.1%

First: 2023. Latest: 2023.

Information Disclosure

1 record2.6%

First: 2023. Latest: 2023.

Patch Status

Patched: 39
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

7.3.4
7.4.9
7.4.8
7.5.0
7.4.6
7.4.3
7.4.1
7.4.0
7.3.0
7.1.7
7.1.6
7.1.3
7.1.2
7.1.0
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
5.13.1
5.12.8
5.12.7
5.12.1
5.10.2
5.0.1
4.10.0
4.9.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.13.3`	WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure	November 27, 2023	7.0.0	Medium
`5.12.5-5.13.0`	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	July 18, 2023	5.13.1	Medium
`*-5.12.7`	Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode	February 27, 2023	5.12.8	Medium
`*-5.12.7`	Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure	February 27, 2023	5.12.8	Medium
`*-5.12.6`	Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting	February 10, 2023	5.12.7	Medium
`*-5.12.6`	Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery	February 10, 2023	5.12.7	Medium
`*-5.12.6`	Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode	February 10, 2023	5.12.7	Medium
`*-5.12.0`	Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery	October 13, 2022	5.12.1	High
`*-5.12.0`	Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting	October 13, 2022	5.12.1	Medium
`*-5.12.0`	Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery	October 2, 2022	5.12.1	High
`[*, 5.10.2)`	WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 23, 2021	5.10.2	Medium
`[*, 5.0.1)`	WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution	October 31, 2017	5.0.1	High
`[*, 4.10.0)`	WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal	June 23, 2017	4.10.0	Medium
`*-4.9.3`	WordPress Shortcodes Plugin — Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting	May 5, 2015	4.9.4	Medium

Selected source records

Latest Records

MediumCVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Published: April 30, 2026

Affected versions: *-3.4.12
Patched versions: 3.4.15

Affected versions: *-2.2.2
Patched versions: 2.2.5

Affected versions: *-3.0.5
Patched versions: 3.0.7

Affected versions: *-2.3.1
Patched versions: 2.3.2

Affected versions: *-2.0.2
Patched versions: 2.0.3

Affected versions: *-1.3.4
Patched versions: Not supplied

Affected versions: *-1.2.7
Patched versions: 1.2.8

Affected versions: *-1.3.1
Patched versions: 1.3.5

Affected versions: *-2.9.2
Patched versions: 2.10.0

Affected versions: *-2.6.7
Patched versions: 2.7.0

Affected versions: *-4.6.8
Patched versions: 4.7.6

Affected versions: *-1.9.2
Patched versions: 1.9.3

Affected versions: *-1.6.22
Patched versions: 1.6.23

Affected versions: *-1.4.2
Patched versions: 1.4.3

Affected versions: *-2.1
Patched versions: 2.2

Affected versions: *-2.6.5
Patched versions: 2.6.7

Affected versions: *-2.2.27
Patched versions: 2.5.1

Affected versions: *-3.2.6
Patched versions: 3.2.8

Affected versions: *-5.17.2
Patched versions: 5.19.0

Affected versions: *-1.1.16
Patched versions: 1.1.17

Affected versions: *-2.5.8
Patched versions: 2.6.1

Affected versions: *-1.1.3
Patched versions: 1.1.10

Affected versions: *-2.5.5
Patched versions: 2.5.6

Affected versions: *-4.2.0
Patched versions: 4.2.1

Affected versions: *-3.0.2
Patched versions: 3.0.3

Affected versions: *-1.5.5
Patched versions: 1.6

Affected versions: *-1.2.56
Patched versions: 1.2.57

Affected versions: *-3.2.4
Patched versions: 3.2.5

Affected versions: *-2.4.1
Patched versions: 2.4.4

Affected versions: *-1.4.0
Patched versions: 1.4.1

Affected versions: *-1.6.3
Patched versions: 1.6.4

Affected versions: *-1.5.140
Patched versions: 1.5.141

Affected versions: *-2.6.0
Patched versions: 2.6.1

Affected versions: *-2.3.4
Patched versions: 2.3.5

Affected versions: *-2.5.7
Patched versions: 2.5.9

Affected versions: *-3.2.6
Patched versions: 3.2.9

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-2.1.6
Patched versions: 2.2.0

Affected versions: *-1.5.10
Patched versions: 1.6.2

Affected versions: *-2.0.7.2
Patched versions: 2.0.7.3

Affected versions: *-2.4.27
Patched versions: 2.4.29

Affected versions: *-3.12.1
Patched versions: 3.13.1

Affected versions: *-6.0.2
Patched versions: Not supplied

Affected versions: *-5.222
Patched versions: 5.225

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.9.0
Patched versions: 1.10.0

Affected versions: *-1.4.7
Patched versions: Not supplied

Affected versions: *-1.4.9
Patched versions: 1.5.0

Affected versions: *-3.5.1
Patched versions: 3.5.2

Affected versions: *-2.16.3.3
Patched versions: 2.16.3.6

Affected versions: *-1.7.2
Patched versions: 1.8.5

Affected versions: *-5.0.57
Patched versions: 5.1.8

Affected versions: *-1.8.99
Patched versions: 2.3.17

Affected versions: *-3.0.0
Patched versions: 3.1.0

Affected versions: *-3.4.9
Patched versions: 3.4.11

Affected versions: *-2.1.34
Patched versions: 2.1.35

Affected versions: *-1.1.13
Patched versions: 1.1.17

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-5.5.8
Patched versions: 5.5.9

Affected versions: *-1.9.4
Patched versions: 1.9.7

Affected versions: *-1.10.4
Patched versions: 1.10.5.1

Affected versions: *-6.1.13
Patched versions: 6.1.14

Affected versions: *-2.9.7
Patched versions: 2.10.0

Affected versions: *-2.2.38
Patched versions: 2.2.39

Affected versions: *-3.12
Patched versions: 3.13

Affected versions: *-2.2.0
Patched versions: 2.3.1

Affected versions: *-2.3.7
Patched versions: 2.3.12

Affected versions: *-3.2.8
Patched versions: 3.2.9

Affected versions: *-2.3.0
Patched versions: 2.3.1

Affected versions: *-2.6.0
Patched versions: 2.10.0

Affected versions: *-2.07
Patched versions: 2.08

Affected versions: *-6.6.5
Patched versions: 6.6.6

Affected versions: *-3.9.6
Patched versions: 3.9.7

Affected versions: *-2.0.82
Patched versions: 2.0.83

Affected versions: *-3.3.2
Patched versions: 3.3.4

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-3.2.4.4
Patched versions: 3.2.4.5

Affected versions: *-2.1.0
Patched versions: 2.2.0

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-2.5.9
Patched versions: 2.5.17

Affected versions: *-2.8.6
Patched versions: 2.8.7

Affected versions: *-1.6.3.2
Patched versions: 1.6.3.3

Affected versions: *-7.3.3
Patched versions: 7.3.4

Affected versions: *-1.0.40
Patched versions: 1.0.41

Affected versions: *-1.10.6
Patched versions: 1.10.8

Affected versions: *-2.4.2
Patched versions: 2.4.4

Affected versions: *-3.3.0
Patched versions: 3.3.2

Affected versions: *-3.3.7
Patched versions: 3.3.8

Affected versions: *-2.25.16
Patched versions: 2.25.19

Affected versions: *-2.0.0
Patched versions: 2.0.1

Affected versions: *-1.13.15
Patched versions: 1.13.16

Affected versions: *-1.6.0
Patched versions: 1.6.1

Affected versions: *-3.0.6
Patched versions: 3.0.7

Affected versions: *-3.2.2
Patched versions: 3.2.3

Affected versions: *-1.5.8
Patched versions: Not supplied

Affected versions: *-5.3.4
Patched versions: 5.4.0

Affected versions: *-3.8.3
Patched versions: 3.8.4

Affected versions: *-1.2.7
Patched versions: 1.2.9

Affected versions: *-2.7.33
Patched versions: 2.7.34

Affected versions: *-5.5.31
Patched versions: 5.5.32

Affected versions: *-2.5.9
Patched versions: 2.6.0

Affected versions: *-2.4.1
Patched versions: 2.4.3

Affected versions: *-4.4.1
Patched versions: 4.4.2

Affected versions: *-1.8.5
Patched versions: 1.9

Affected versions: *-1.16.3
Patched versions: 1.16.4

Affected versions: *-1.3.3
Patched versions: 1.3.4

Affected versions: *-2.3.11
Patched versions: Not supplied

Affected versions: *-1.8.4.8.1
Patched versions: 1.8.4.9.1

Affected versions: *-3.1.28
Patched versions: 3.2.2

Affected versions: *-8.0.7
Patched versions: 8.0.8

Affected versions: *-2.1.5
Patched versions: Not supplied

Affected versions: *-1.6.0
Patched versions: 1.6.5

Affected versions: *-1.9.8
Patched versions: 2.0.19

Affected versions: *-1.2.6
Patched versions: Not supplied

Affected versions: *-4.5.0
Patched versions: 4.5.1

Affected versions: *-1.0.4
Patched versions: 1.1

Affected versions: *-1.7.34
Patched versions: 1.8.12

Affected versions: *-6.1.10
Patched versions: 6.1.11

Affected versions: *-2.8.4
Patched versions: Not supplied

Affected versions: *-3.1.26
Patched versions: 3.1.28

Affected versions: *-3.12.0
Patched versions: 3.16.0

Affected versions: *-2.24.6
Patched versions: 2.25.2

Affected versions: *-7.7.0
Patched versions: 7.7.3

Affected versions: *-2.7.0
Patched versions: 2.7.7

Affected versions: *-3.7.3
Patched versions: Not supplied

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-1.6.3
Patched versions: 1.6.6

Affected versions: *-1.9.0
Patched versions: 1.21.0

Affected versions: *-1.6.6
Patched versions: 1.7.5

Affected versions: *-1.5.8
Patched versions: 1.6.1

Original Wordfence record

MediumCVE-2026-3885

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode

Published: April 15, 2026

Affected versions: *-7.4.9
Patched versions: 7.5.0

Original Wordfence record

MediumCVE-2026-0738

Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode

Published: April 3, 2026

Affected versions: *-7.4.8
Patched versions: 7.4.9

Original Wordfence record

MediumCVE-2026-0737

Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode

Published: April 3, 2026

Affected versions: *-7.4.7
Patched versions: 7.4.8

Original Wordfence record

MediumCVE-2026-2480

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute

Published: March 31, 2026

Affected versions: *-7.4.10
Patched versions: 7.5.0

Original Wordfence record

MediumCVE-2025-12800

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery

Published: November 23, 2025

Affected versions: *-7.4.5
Patched versions: 7.4.6

Original Wordfence record

MediumCVE-2025-8015

Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link

Published: July 21, 2025

Affected versions: *-7.4.2
Patched versions: 7.4.3

Original Wordfence record

MediumCVE-2025-7354

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

Published: July 20, 2025

Affected versions: *-7.4.2
Patched versions: 7.4.3

Original Wordfence record

Highest-Severity Records

HighCVE-2022-38086

Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery

Published: October 2, 2022

Affected versions: *-5.12.0
Patched versions: 5.12.1

Original Wordfence record

HighCVE-2022-41136

Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery

Published: October 13, 2022

Affected versions: *-5.12.0
Patched versions: 5.12.1

Original Wordfence record

HighCVE-2017-18580

WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution

Published: October 31, 2017

Affected versions: [*, 5.0.1)
Patched versions: 5.0.1

Original Wordfence record

MediumCVE-2023-0911

Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure

Published: February 27, 2023

Affected versions: *-5.12.7
Patched versions: 5.12.8

Original Wordfence record

MediumCVE-2023-25050

Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode

Published: February 10, 2023

Affected versions: *-5.12.6
Patched versions: 5.12.7

Original Wordfence record

MediumCVE-2023-23800

Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery

Published: February 10, 2023

Affected versions: *-5.12.6
Patched versions: 5.12.7

Original Wordfence record

MediumCVE-2024-0792

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

Published: February 7, 2024

Affected versions: *-7.0.1
Patched versions: 7.0.2

Original Wordfence record

MediumCVE-2025-49244

Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 5, 2025

Affected versions: *-7.3.5
Patched versions: 7.4.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory