The WP Shortcodes Plugin — Shortcodes Ultimate has a stored XSS flaw that allows an attacker to embed arbitrary scripts via the 'data-url' attribute. When a page containing the injected payload is viewed, the script executes in the victim’s browser, enabling credential theft, session hijacking, or defacement. The vulnerability is caused by inadequate sanitization of user input and insufficient escaping when rendering the attribute, which aligns with the CWE‑79 weakness of cross‑site scripting.

WordPress sites that have installed the Shortcodes Ultimate plugin, versions 7.4.0 and earlier, are affected. The issue exists across all releases up to and including 7.4.0, regardless of site configuration.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector requires an authenticated user with Contributor privileges or higher, meaning that anyone with sufficient role access can inject malicious scripts into the plugin’s output. Once injected, any visitor who views the affected page will automatically run the payload, making this a high‑impact attack path for privileged users.