The Shortcodes Ultimate plugin for WordPress is vulnerable because uploaded images are saved with their title and slide link fields without proper sanitization or escaping. An authenticated author or higher user can inject arbitrary JavaScript into these fields, and when a visitor later views a page containing the affected image, the script executes in that visitor’s browser. This flaw is a classic example of CWE‑79, potentially leading to defacement, credential theft, or further session compromise.

WP Shortcodes Plugin – Shortcodes Ultimate, all releases up to and including version 7.4.2. The issue resides solely in the plugin code and applies to any WordPress installation using those versions.

The CVSS score of 6.4 denotes medium severity, while an EPSS score of less than 1% indicates a very low current exploitation likelihood. The flaw is not listed in CISA’s KEV catalog. Because the attack requires authenticated author or higher access, the attack surface is limited to users who can upload or edit media within the WordPress site. Once injection succeeds, any visitor who views the affected media is exposed to the malicious script.