CVE-2024-1510 in WP Shortcodes Plugin
Summary
by MITRE • 02/20/2024
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied tags. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The WP Shortcodes Plugin — Shortcodes Ultimate represents a widely used WordPress extension that enables users to create various interactive elements through shortcode functionality. This particular vulnerability affects versions up to and including 7.0.2, creating a significant security risk for WordPress installations that rely on this plugin for content management and user interaction features. The flaw exists within the su_tooltip shortcode implementation, which processes user-supplied attributes and tags without adequate sanitization measures.
The technical vulnerability stems from insufficient input validation and output escaping mechanisms within the plugin's codebase. When administrators or contributors create content using the su_tooltip shortcode, the plugin fails to properly sanitize user-provided data before rendering it in the final output. This allows malicious actors to inject malicious JavaScript code through attributes or tag parameters that are then executed in the context of other users' browsers. The vulnerability specifically targets the plugin's handling of user-supplied input within the tooltip functionality, where data flows from user input directly to HTML output without proper sanitization.
Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability to inject arbitrary web scripts into pages that will execute whenever any user accesses those pages. This creates a persistent threat vector where malicious code can be stored within the WordPress database and executed repeatedly against unsuspecting users. The impact extends beyond simple script execution as it allows for more sophisticated attacks including session hijacking, data exfiltration, and potential privilege escalation within the WordPress environment. The stored nature of the XSS vulnerability means that the malicious payload remains active until manually removed from the content or database.
This vulnerability aligns with CWE-79 which identifies Cross-Site Scripting as a fundamental web application security flaw, and maps to ATT&CK technique T1566.001 for initial access through malicious content. The attack surface is particularly concerning given that contributors typically have significant editing privileges within WordPress installations, making it relatively easy for attackers to establish persistent malicious content. Organizations using this plugin should immediately update to the latest version where the vulnerability has been patched, implement proper input validation measures, and conduct thorough security audits of existing content. Additionally, implementing Content Security Policies and monitoring for suspicious shortcode usage can provide additional defense layers against similar vulnerabilities.
The exploitation of this vulnerability demonstrates the critical importance of proper input sanitization in web applications, particularly within content management systems where user-generated content is prevalent. WordPress plugins must implement robust security measures to prevent malicious data from being stored and executed, as the impact of such vulnerabilities can extend far beyond individual plugin functionality to compromise entire WordPress installations. Regular security updates and proactive vulnerability management are essential practices to maintain the integrity of WordPress environments and protect against persistent threats like stored XSS attacks that can remain undetected for extended periods.