CVE-2017-18580: Getshortcodes Shortcodes Ultimate

Critical severity, CVSS 9.8. EPSS: 12.1% chance of exploitation in the next 30 days.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

Affected products

• Getshortcodes Shortcodes Ultimate: before 5.0.1 (fixed in 5.0.1)

Published 2019-08-22. Last modified 2026-06-17.