Shortcoder Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issue affects Shortcoder: from n/a through <= 6.5.1.

Affected:

up to 6.5.1

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-27074 on NVD →

The Shortcoder — Create Shortcodes for Anything plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arb...

CVSS:

6.4

Affected:

up to 6.5.1

Fixed in:

6.5.2

Disclosed:

Jan 9, 2026

CVE-2026-27074 on NVD →

[en] Missing Authorization vulnerability in Aakash Chakravarthy Shortcoder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcoder: from n/a through 6.3.

Affected:

up to 6.3.1

Fixed in:

6.3.1

Disclosed:

Dec 9, 2024

CVE-2023-49849 on NVD →

The Shortcoder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 6.3

Fixed in:

6.3.1

Disclosed:

Dec 6, 2023

CVE-2023-49849 on NVD →