CVE-2023-25040: Getshortcodes Shortcodes Ultimate

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.

Affected products

• Getshortcodes Shortcodes Ultimate: before 5.12.7 (fixed in 5.12.7)

Published 2023-03-30. Last modified 2026-06-17.