Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode

Description

A vulnerability marked as problematic has been reported in gn_themes WP Shortcodes Plugin up to 7.4.8 on WordPress. This vulnerability affects unknown code of the component Shortcode Handler. This manipulation of the argument su_slide_link causes cross site scripting. This vulnerability appears as CVE-2026-0738. The attack may be initiated remotely. It is suggested to upgrade the affected component.

Affected Products

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=cve
• https://research.cleantalk.org/cve-2026-0738/
• https://plugins.trac.wordpress.org/changeset?old_path=shortcodes-ultimate/tags/7.4.8/includes/shortcodes/carousel.php&new_path=shortcodes-ultimate/tags/7.4.9/includes/shortcodes/carousel.php

Related News (1 articles)