The vulnerability arises from insufficient sanitization of the src attribute in the su_lightbox shortcode of the Shortcodes Ultimate plugin. An authenticated contributor or higher can store malicious JavaScript within that attribute, which in turn is rendered on pages viewed by other users. The stored code runs in every visitor’s browser, enabling attacks such as session hijacking, defacement, or other client‑side exploits.

All WordPress installations that use the WP Shortcodes Plugin – Shortcodes Ultimate and have a version of 7.4.7 or earlier are affected. The official fix was delivered in version 7.4.8, which removes the vulnerability.

The CVSS score of 6.4 reflects moderate severity. Because an attacker must first obtain authenticated access at the contributor level or higher, the risk is confined to sites where such roles are granted. Exploit probability data is currently unavailable, and the vulnerability is not listed in the known exploited vulnerabilities catalog. Once the required privileges are attained, the stored script can be delivered to any user viewing the affected page, posing a significant threat to confidentiality, integrity, and user trust.