CVE-2022-41136

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Score

CVSS 3.1 8.8 High

Status

Modified - audit@patchstack.com

Published

2022-11-08

Last modified

2026-04-28

Weaknesses

CWE-352, CWE-79

Affected products

• Shortcodes Ultimate (Getshortcodes)
• Shortcodes Ultimate Wordpress Plugin (Vladimir Anokhin)

References

• https://patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-csrf-vuln…
• https://wordpress.org/plugins/shortcodes-ultimate/#developers