Shortcodes Ultimate <= 7.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode 'type' Attribute
- ID
- WPSEC-2026-0259
- Plugin
- Shortcodes Ultimate – Content Elements (shortcodes-ultimate)
- Affected
- all versions before 7.9.1
- Remediation
- Update to 7.9.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Shortcodes Ultimate on WPSec AttackSurface
- Fix released
- Published
Description
The Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_lightbox shortcode and its front-end lightbox handler in all versions up to, and including, 7.9.0. This is due to the plugin not restricting the Magnific Popup content type: the 'type' attribute accepts 'ajax', 'mfp-*' CSS classes override the type, and the handler also acts on su-lightbox elements written directly into post content, so remote HTML could be loaded into the page or an inline source handed to jQuery as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user opens the injected lightbox.
References
- https://wpsec.com/vuln/WPSEC-2026-0259/
- https://plugins.svn.wordpress.org/shortcodes-ultimate/tags/7.9.1/
- https://wordpress.org/plugins/shortcodes-ultimate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS