Forget About Shortcode Buttons Vulnerabilities

The Forget About Shortcode Buttons plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.1.3

Fix:

No patched version reported

Disclosed:

Jun 26, 2026

CVE-2025-63041 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Nov 9, 2023

CVE-2023-32579 on NVD →

The Forget About Shortcode Buttons plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the fasc_buttons function in versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access or higher, to update the p...

CVSS:

4.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

May 11, 2023

CVE-2023-32579 on NVD →

[en] Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1

Affected:

up to 1.1.2

Fixed in:

1.1.2

Disclosed:

Oct 10, 2016

CVE-2016-1000133 on NVD →

The Forget About Shortcode Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ajax_url’ variable in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 1.1.1

Fixed in:

1.1.2

Disclosed:

Feb 29, 2016

CVE-2016-1000133 on NVD →