Executive brief
Shortcodes Ultimate, a popular WordPress plugin used to add visual elements to websites, contains a security flaw that allows users with 'Contributor' permissions to inject malicious scripts into pages. When other users or administrators visit these pages and interact with the affected content, the hidden scripts can execute in their browser. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Shortcodes Ultimate plugin for WordPress due to insufficient input sanitization and output escaping of the 'src' attribute within the 'su_lightbox' shortcode. Specifically, the plugin fails to properly validate URL protocols, allowing entity-encoded JavaScript schemes (e.g., 'javascript:') to be processed and rendered in the frontend link. An authenticated attacker with Contributor-level permissions or higher can embed a malicious shortcode into a post. When a site visitor or administrator clicks the resulting lightbox link, the injected script executes within the context of their browser session. This issue is resolved in version 7.4.8.
Affected products
- gn_themes Shortcodes Ultimate <= 7.4.7
Timeline
- 2025-12-30: other: Vulnerability discovered and reported to vendor
- 2026-04-03: patched: Fixed in version 7.4.8
- 2026-04-04: disclosed: Public advisory released