WordPress plugin
Shortcodes Ultimate – Content Elements security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High3
- Medium36
- Low0
All Shortcodes Ultimate – Content Elements vulnerabilities
- Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
≤5.5.8Update to 5.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
≤7.4.9Update to 7.5.0
- Medium6.4authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
≤7.4.8Update to 7.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
≤7.4.7Update to 7.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
≤7.4.10Update to 7.5.0
- Medium6.4Authenticated (Administrator+) Server-Side Request Forgery
≤7.4.5Update to 7.4.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
≤7.4.2Update to 7.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
≤7.4.2Update to 7.4.3
- Medium6.1Cross-Site Request Forgery to Arbitrary Shortcode Execution
≤7.4.2Update to 7.4.3
- Medium6.4Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
≤7.4.0Update to 7.4.1
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.3.5Update to 7.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
≤7.3.3Update to 7.3.4
- Medium5.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
≤7.2.2Update to 7.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
≤7.1.6Update to 7.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
≤7.1.5Update to 7.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤7.1.2Update to 7.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox
≤7.1.0Update to 7.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.0.5Update to 7.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode
≤7.0.4Update to 7.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode
≤7.0.3Update to 7.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode
≤7.0.2Update to 7.0.3
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
≤7.0.1Update to 7.0.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.0.0Update to 7.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.13.3Update to 7.0.0
- Medium4.3Insecure Direct Object Reference to Information Disclosure
≤5.13.3Update to 7.0.0
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- Medium4.3Authenticated (Subscriber+) Arbitrary Post Access via Shortcode
≤5.12.7Update to 5.12.8
- Medium6.5Authenticated (Subscriber+) Information Exposure
≤5.12.7Update to 5.12.8
- Medium6.5Authenticated (Subscriber+) Server-Side Request Forgery
≤5.12.6Update to 5.12.7
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Shortcode
≤5.12.6Update to 5.12.7
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
≤5.12.6Update to 5.12.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.12.0Update to 5.12.1
- High8.8Cross-Site Request Forgery
≤5.12.0Update to 5.12.1
- High8.8Cross-Site Request Forgery
≤5.12.0Update to 5.12.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
<5.10.2Update to 5.10.2
- High8.8Authenticated Remote Code Execution
<5.0.1Update to 5.0.1
- Medium5.0Directory Traversal
<4.10.0Update to 4.10.0
- Medium6.1Cross-Site Scripting
≤4.9.3Update to 4.9.4
Shortcodes Ultimate – Content Elements: common questions
Does Shortcodes Ultimate – Content Elements have known vulnerabilities?
Yes. VulnCrest Radar lists 39 known vulnerabilities in Shortcodes Ultimate – Content Elements: 3 high, 36 medium. At least one is not fixed in the latest version.
How do I check which version of Shortcodes Ultimate – Content Elements I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Shortcodes Ultimate – Content Elements vulnerability?
CVE-2024-13362, published Apr 30, 2026: Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter. Severity: Medium (CVSS 6.1).
Is any Shortcodes Ultimate – Content Elements vulnerability listed in CISA KEV?
No. None of the known Shortcodes Ultimate – Content Elements vulnerabilities is currently listed in the CISA KEV catalog.