CVE-2024-6766

The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:pro:wordpress:*:*

History

13 Jun 2025, 00:16

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:pro:wordpress:*:*
References () https://wpscan.com/vulnerability/77bb1dcf-4e84-497a-955e-f3c0b649ad1c/ - () https://wpscan.com/vulnerability/77bb1dcf-4e84-497a-955e-f3c0b649ad1c/ - Exploit, Third Party Advisory
First Time Getshortcodes
Getshortcodes shortcodes Ultimate

06 Aug 2024, 14:35

Type Values Removed Values Added
Summary
  • (es) El complemento shortcodes-ultimate-pro de WordPress anterior a 7.2.1 no valida ni escapa algunos de sus atributos de shortcode antes de devolverlos a una página/publicación donde está incrustado el shortcode, lo que podría permitir a los usuarios con el rol de colaborador y superiores ataques de Cross-Site Scripting Almacenado.
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4

06 Aug 2024, 06:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-06 06:15

Updated : 2025-06-13 00:16


NVD link : CVE-2024-6766

Mitre link : CVE-2024-6766

CVE.ORG link : CVE-2024-6766


JSON object : View

Products Affected

getshortcodes

  • shortcodes_ultimate
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')