Medium · 6.1 CVE-2022-41136 EUVD-2022-44378GHSA-2hrr-4p8h-j38c

WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

Published Nov 8, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Vladimir Anokhin Product: Shortcodes Ultimate (WordPress plugin) Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Affected products

Vendor	Product	Affected	Fixed
Vladimir Anokhin	Shortcodes Ultimate (WordPress plugin)	<= 5.12.0 – ≤ 5.12.0	—

References

https://wordpress.org/plugins/shortcodes-ultimate/#developers
https://patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-csrf-vulnerability-leading-to-stored-xss?_s_id=cve