CVE-2024-4217: Getshortcodes Shortcodes Ultimate

Medium severity, CVSS 4.7. EPSS: 0.5% chance of exploitation in the next 30 days.

The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.

Affected products

• Getshortcodes Shortcodes Ultimate: before 7.1.5 (fixed in 7.1.5)

Published 2024-07-13. Last modified 2026-06-17.