WordPress plugin
Shortcodes Ultimate – Content Elements security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High3
- Medium36
- Low0
All Shortcodes Ultimate – Content Elements vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Cross-Site Request Forgery ≤5.12.0Update to 5.12.1 | CVE-2022-41136 | |
| High8.8 | Cross-Site Request Forgery ≤5.12.0Update to 5.12.1 | CVE-2022-38086 | |
| High8.8 | Authenticated Remote Code Execution <5.0.1Update to 5.0.1 | CVE-2017-18580 |
- High8.8Cross-Site Request Forgery
≤5.12.0Update to 5.12.1
- High8.8Cross-Site Request Forgery
≤5.12.0Update to 5.12.1
- High8.8Authenticated Remote Code Execution
<5.0.1Update to 5.0.1
Shortcodes Ultimate – Content Elements: common questions
Does Shortcodes Ultimate – Content Elements have known vulnerabilities?
Yes. VulnCrest Radar lists 39 known vulnerabilities in Shortcodes Ultimate – Content Elements: 3 high, 36 medium. At least one is not fixed in the latest version.
How do I check which version of Shortcodes Ultimate – Content Elements I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Shortcodes Ultimate – Content Elements vulnerability?
CVE-2024-13362, published Apr 30, 2026: Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter. Severity: Medium (CVSS 6.1).
Is any Shortcodes Ultimate – Content Elements vulnerability listed in CISA KEV?
No. None of the known Shortcodes Ultimate – Content Elements vulnerabilities is currently listed in the CISA KEV catalog.