Security Alert Summary
The WP Shortcodes Plugin – Shortcodes Ultimate for WordPress contains a stored cross-site scripting (XSS) vulnerability in the su_box shortcode. Insufficient input sanitization and output escaping for the max_width attribute in affected versions allows authenticated users with contributor-level access or higher to inject script content that will execute when a page containing the injected shortcode is viewed.
CVE Details
- CVE ID: CVE-2026-2480
- Affected component: WP Shortcodes Plugin – Shortcodes Ultimate plugin for WordPress
- Affected versions: All versions up to and including 7.4.10
- Published: March 31, 2026 at 11:17:08 PM
- Last modified: April 1, 2026 at 2:23:37 PM
- CVSS v3.1: Base Score 6.4, MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction:
- Authentication: authenticated users (contributor-level access and above)
- Privileges Required: LOW
- User Interaction: NONE
- Attack Vector: NETWORK
- Scope: CHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping of user-supplied attributes for the su_box shortcode. Specifically, the max_width attribute can contain attacker-controlled values that are not properly sanitized or escaped before being rendered on pages.
An authenticated user with contributor-level access or higher can create or edit content that includes a crafted su_box shortcode with a malicious max_width attribute. When another user views the page containing the injected shortcode, the injected script code is executed in the context of the viewer’s browser, allowing actions consistent with a stored XSS impact (for example, script-driven UI actions, data exposure within the page, or session-based interactions available to the viewer).
The issue exists because user-supplied shortcode attributes are handled without sufficient sanitization and output escaping, allowing arbitrary script payloads to be stored and later rendered to site visitors.
How This Could Impact Your Website
Consider a site with multiple contributors: a site owner who manages overall settings, internal staff who create and edit pages, and external contractors who contribute content. If a contributor or compromised contractor submits content containing a malicious su_box shortcode using the max_width attribute, that payload can be stored and executed whenever other users visit the affected page.
- Internal staff or editors viewing the page could have page-level data exposed to an attacker-controlled script.
- Exposed emails or page content can increase the risk of targeted phishing or social engineering against staff or subscribers.
- While the CVSS impacts indicate limited confidentiality and integrity effects rather than full system takeover, the presence of stored XSS still enables browser-based attacks against users who view injected pages.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and page content for unusual changes or unexpected shortcode usage.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shortcodes/box.php#L107
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shortcodes/box.php#L113
- https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate/trunk/includes/shortcodes/box.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/61ab7a28-bcca-41ff-89d1-c083c6b0d39f?source=cve
