The plugin accepts a 'max_width' attribute on the su_box shortcode and does not properly escape user input. An attacker who has contributor‑level access can supply malicious JavaScript in this attribute. The code is stored in the database and rendered in any page that uses the shortcode, meaning that every visitor to the affected page will execute the injected script. This can lead to session hijacking, cookie theft, malicious redirects, or defacement.

The vulnerability exists in the WP Shortcodes Plugin – Shortcodes Ultimate for WordPress, every version up to and including 7.4.10. Users with contributor or higher privileges are able to inject the payload, though any site visitor may be impacted when the malicious content is displayed.

The CVSS score of 6.4 indicates moderate severity. Because the attacker must be authenticated, the likelihood of exploitation is lower than a fully remote vulnerability; however, once authenticated the script executes for all users. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The most probable attack path is an authenticated contributor editing a page or post that contains the su_box shortcode and inserting malicious code into the 'max_width' field.