Arconix Shortcodes Vulnerabilities

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 2.1.19

Fix:

No patched version reported

Disclosed:

Dec 1, 2025

CVE-2025-13835 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tyche Softwares Arconix Shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through 2.1.19.

Affected:

up to 2.1.19

Fix:

No patched version reported

Disclosed:

Dec 1, 2025

CVE-2025-13835 on NVD →

[en] Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.

Affected:

up to 2.1.18

Fix:

No patched version reported

Disclosed:

Nov 21, 2025

CVE-2025-66085 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.1.18

Fixed in:

2.1.19

Disclosed:

Oct 30, 2025

CVE-2025-66085 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes allows Stored XSS. This issue affects Arconix Shortcodes: from n/a through 2.1.17.

Affected:

up to 2.1.18

Fixed in:

2.1.18

Disclosed:

Jun 17, 2025

CVE-2025-49858 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 2.1.17

Fixed in:

2.1.18

Disclosed:

Jun 12, 2025

CVE-2025-49858 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes allows Reflected XSS. This issue affects Arconix Shortcodes: from n/a through 2.1.16.

Affected:

up to 2.1.17

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-47673 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...

CVSS:

6.1

Affected:

up to 2.1.16

Fixed in:

2.1.17

Disclosed:

May 16, 2025

CVE-2025-47673 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes allows Reflected XSS. This issue affects Arconix Shortcodes: from n/a through 2.1.15.

Affected:

up to 2.1.16

Fixed in:

2.1.16

Disclosed:

Apr 17, 2025

CVE-2025-24621 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tyche Softwares Arconix Shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through 2.1.14.

Affected:

up to 2.1.15

Fixed in:

2.1.15

Disclosed:

Jan 2, 2025

CVE-2024-56242 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 2.1.14

Fixed in:

2.1.15

Disclosed:

Dec 30, 2024

CVE-2024-56242 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ...

CVSS:

6.1

Affected:

up to 2.1.15

Fixed in:

2.1.16

Disclosed:

Dec 30, 2024

CVE-2025-24621 on NVD →

[en] Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.

Affected:

up to 2.1.12

Fixed in:

2.1.12

Disclosed:

Nov 1, 2024

CVE-2024-38769 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...

CVSS:

6.4

Affected:

up to 2.1.13

Fixed in:

2.1.14

Disclosed:

Oct 29, 2024

CVE-2024-10226 on NVD →

[en] The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with con...

Affected:

up to 2.1.14

Fixed in:

2.1.14

Disclosed:

Oct 29, 2024

CVE-2024-10226 on NVD →

[en] The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

Affected:

up to 2.1.13

Fixed in:

2.1.13

Disclosed:

Oct 18, 2024

CVE-2024-9703 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contr...

CVSS:

6.4

Affected:

up to 2.1.12

Fixed in:

2.1.13

Disclosed:

Oct 17, 2024

CVE-2024-9703 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ts_reset_tracking_setting() function in versions up to, and including, 2.1.11. This makes it possible for unauthenticated attackers to reset the tracking data.

CVSS:

5.3

Affected:

up to 2.1.11

Fixed in:

2.1.12

Disclosed:

Jul 19, 2024

CVE-2024-38769 on NVD →

[en] Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ:...

Affected:

up to 2.1.11

Fixed in:

2.1.11

Disclosed:

May 8, 2024

CVE-2024-4233 on NVD →

Multiple plugins for WordPress by tychesoftwares are vulnerable to unauthorized modification of data due to a missing capability check on the ts_admin_notices() function in various versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss tracking notices.

CVSS:

4.3

Affected:

up to 2.1.10

Fixed in:

2.1.11

Disclosed:

Apr 26, 2024

CVE-2024-4233 on NVD →

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Arconix Shortcodes plugin <= 2.1.7 versions.

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

May 16, 2023

CVE-2023-23703 on NVD →

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via one or more shortcodes including the 'box_arconix_shortcode' in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on the user-supplied attributes. This makes it possible for authent...

CVSS:

6.4

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Apr 24, 2023

CVE-2023-23703 on NVD →