Är WP Shortcodes Plugin — Shortcodes Ultimate säkert att använda?

WP Shortcodes Plugin — Shortcodes Ultimate har 31 kända sårbarheter. De flesta åtgärdas i nya versioner. Håll alltid tillägget uppdaterat för bästa skydd.

Hur vet jag om min sajt är påverkad?

Kör ett gratis test på sitesupport.co/testa-din-hemsida. Testet kontrollerar vilka tillägg och versioner du använder och jämför mot kända sårbarheter.

Vad ska jag göra om jag har en sårbar version?

Uppdatera till senaste versionen så snart som möjligt. Om ingen fix finns tillgänglig, överväg att tillfälligt inaktivera tillägget.

WP Shortcodes Plugin — Shortcodes Ultimate

Name: WP Shortcodes Plugin — Shortcodes Ultimate
Rating: 4.9

4.9/5

400 000+ installationer

A comprehensive collection of visual components for your site

Kända sårbarheter

Kritiska / höga

2025-11-23

Senaste sårbarhet

400 000+

Aktiva installationer

Om WP Shortcodes Plugin — Shortcodes Ultimate

Om Shortcodes Ultimate

WP Shortcodes Plugin — Shortcodes Ultimate är ett populärt WordPress-tillägg som används av över 400 000 webbplatser. Tillägget erbjuder en omfattande samling visuella komponenter som knappar, kolumner, bildgallerier och andra designelement som enkelt kan läggas till via kortkoder (shortcodes).

Säkerhetsläget

Tillägget har 25 dokumenterade sårbarheter, varav 24 klassificeras som medium-risk och 1 som hög risk. Den senaste kända sårbarheten rapporterades så sent som november 2025, vilket visar att säkerhetsproblem fortfarande upptäcks.

Medium-risk sårbarheter innebär vanligtvis att angripare behöver viss åtkomst eller specifika förutsättningar för att utnyttja dem, medan high-risk sårbarheten kan vara allvarligare och enklare att exploatera.

Våra rekommendationer

Trots sårbarheterna är tillägget fortfarande användbart om du följer god säkerhetspraxis:

Håll alltid tillägget uppdaterat till senaste versionen
Begränsa administratörsåtkomst till betrodda användare
Använd säkra lösenord och tvåfaktorsautentisering
Överväg att använda ett säkerhets-tillägg för extra skydd

Regelbundna uppdateringar är det mest effektiva skyddet mot kända sårbarheter och bör alltid prioriteras för alla WordPress-tillägg.

Använder du WP Shortcodes Plugin — Shortcodes Ultimate?

Kör ett gratis test och se om din hemsida är påverkad av dessa sårbarheter.

Testa din hemsida

Alla kända sårbarheter

Medel 2025-11-23 CVE-2025-12800

CVE-2025-12800: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table functio...

Påverkade versioner: all

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers,...

Medel 2025-11-23 CVE-2025-12800

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery

Påverkade versioner: <= 7.4.5

Medel 2025-07-22 CVE-2025-8015

CVE-2025-8015: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and...

Påverkade versioner: all

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitizatio...

Medel 2025-07-21 CVE-2025-7369

CVE-2025-7369: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect no...

Påverkade versioner: all

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it p...

Medel 2025-07-21 CVE-2025-7354

CVE-2025-7354: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to ins...

Påverkade versioner: all

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on use...

Medel 2025-07-21 CVE-2025-8015

Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link

Påverkade versioner: <= 7.4.2

Medel 2025-07-20 CVE-2025-7354

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

Påverkade versioner: <= 7.4.2

Medel 2025-07-20 CVE-2025-7369

Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

Påverkade versioner: <= 7.4.2

Medel 2025-07-04 CVE-2025-5567

CVE-2025-5567: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4...

Påverkade versioner: < 7.4.1

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output es...

Medel 2025-07-03 CVE-2025-5567

Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute

Påverkade versioner: <= 7.4.0

Medel 2025-06-05 CVE-2025-49244

Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Påverkade versioner: <= 7.3.5

Medel 2025-03-04 CVE-2025-0370

CVE-2025-0370: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to ins...

Påverkade versioner: < 7.3.4

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This make...

Medel 2024-10-23 CVE-2024-8500

CVE-2024-8500: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insu...

Påverkade versioner: < 7.3.0

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 7.2.2 due to insufficient input sanitization and output escaping. This m...

Medel 2024-06-05 CVE-2024-4821

CVE-2024-4821: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6...

Påverkade versioner: < 7.1.7

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output esca...

Medel 2024-05-21 CVE-2024-4553

CVE-2024-4553: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1....

Påverkade versioner: < 7.1.6

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output esc...

Medel 2024-05-15 CVE-2024-3548

CVE-2024-3548: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scri...

Påverkade versioner: < 7.1.2

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users...

Medel 2024-05-02 CVE-2024-3550

CVE-2024-3550: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to i...

Påverkade versioner: < 7.1.3

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on u...

Medel 2024-04-26 CVE-2024-3188

CVE-2024-3188: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho...

Påverkade versioner: < 7.1.0

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contr...

Medel 2024-04-13 CVE-2024-2583

CVE-2024-2583: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible fo...

Påverkade versioner: < 7.0.5

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS...

Medel 2024-02-29 CVE-2024-0792

CVE-2024-0792: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to i...

Påverkade versioner: < 7.0.2

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on R...

Medel 2024-02-28 CVE-2024-1808

CVE-2024-1808: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3...

Påverkade versioner: < 7.0.4

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output esca...

Medel 2024-02-20 CVE-2024-1510

CVE-2024-1510: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 ...

Påverkade versioner: < 7.0.3

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escap...

Medel 2023-12-19 CVE-2023-6488

CVE-2023-6488: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versio...

Påverkade versioner: <= 7.0.0

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient inpu...

Medel 2023-11-28 CVE-2023-6226

CVE-2023-6226: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to...

Påverkade versioner: < 7.0.0

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' a...

Medel 2023-11-28 CVE-2023-6225

CVE-2023-6225: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up...

Påverkade versioner: < 7.0.0

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sa...

Medel 2023-03-30 CVE-2023-25040

CVE-2023-25040: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.

Påverkade versioner: < 5.12.7

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.

Medel 2023-03-20 CVE-2023-0911

CVE-2023-0911: The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such ...

Påverkade versioner: < 5.12.8

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except t...

Medel 2023-03-20 CVE-2023-0890

CVE-2023-0890: The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the u...

Påverkade versioner: < 5.12.8

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated user...

Hög 2022-11-08 CVE-2022-41136

CVE-2022-41136: Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Påverkade versioner: <= 5.12.0

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Medel 2022-10-11 CVE-2022-38086

CVE-2022-38086: Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.

Påverkade versioner: <= 5.12.0

Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.

Medel 2021-09-20 CVE-2021-24525

CVE-2021-24525: The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortc...

Påverkade versioner: < 5.10.2

The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there...

Så skyddar du din sajt

Sårbarheter i tillägg är den vanligaste attackytan för WordPress-sajter. Det bästa skyddet är att vara proaktiv — här är tre konkreta steg.

Håll tillägget uppdaterat

De flesta sårbarheter i WP Shortcodes Plugin — Shortcodes Ultimate åtgärdas snabbt av utvecklarna. Uppdatera alltid till senaste versionen.

Ta bort oanvända tillägg

Varje tillägg är en potentiell attackyta. Avinstallera det du inte aktivt använder.

Bevaka automatiskt

Med löpande övervakning upptäcker du problem innan de blir allvarliga.

Vill du slippa hålla koll själv? Med ett supportavtal från Sitesupport sköter vi uppdateringar och säkerhet åt dig.

Vanliga frågor om WP Shortcodes Plugin — Shortcodes Ultimate

WP Shortcodes Plugin — Shortcodes Ultimate har 31 kända sårbarheter, varav 1 med hög eller kritisk allvarlighetsgrad. Det betyder inte nödvändigtvis att tillägget är osäkert — de flesta sårbarheter åtgärdas i nya versioner. Det viktigaste är att alltid köra den senaste versionen.

Det enklaste sättet är att köra ett gratis test av din hemsida på sitesupport.co. Testet kontrollerar vilka tillägg du använder och vilka versioner som är installerade, och jämför det mot kända sårbarheter.

Uppdatera till den senaste versionen så snart som möjligt. Om det inte finns en uppdatering som åtgärdar problemet bör du överväga att tillfälligt inaktivera tillägget, särskilt om sårbarheten har kritisk eller hög allvarlighetsgrad.

WP Shortcodes Plugin — Shortcodes Ultimate har över 400 000 aktiva installationer på WordPress.org och ett betyg på 4.9 av 5. Populära tillägg har generellt bättre säkerhetsrutiner tack vare större community och fler ögon på koden.