CVE-2025-7369mediumCWE-352

CVE-2025-7369: fallo de gravedad media en gn_themes WP Shortcodes Plugin — Shortcodes…

Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP Shortcodes Plugin — Shortcodes Ultimate

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.2%
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
gn_themes · WP Shortcodes Plugin — Shortcodes Ultimate
CVEs relacionadas — gn_themes WP Shortcodes Plugin — Shortcodes…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-0370MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src ParameterEPSS 36.8%CVE-2024-3550MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2023-6226MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information DisclosureEPSS 0.5%CVE-2023-6225MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2023-6488MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%