📄 Description (English)
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
🤖 AI Executive Summary
The WP Shortcodes Plugin (Shortcodes Ultimate) versions up to 7.4.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the su_box shortcode's max_width attribute. Authenticated attackers with contributor-level access can inject malicious scripts that execute for all users viewing affected pages. This vulnerability poses a significant risk to WordPress-based government portals, corporate websites, and e-commerce platforms commonly used across Saudi Arabia.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 16, 2026 04:54
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability primarily affects Saudi organizations using WordPress with the Shortcodes Ultimate plugin, including: Government agencies (NCA, CITC, ARAMCO portals), Banking sector (SAMA-regulated institutions), Healthcare providers (MOH systems), E-commerce platforms, and Educational institutions. The stored XSS nature means persistent compromise of website integrity. Attackers with contributor access (common in multi-author environments) can deface pages, steal user credentials, redirect traffic, or inject malware affecting all visitors. This is particularly critical for SAMA-regulated financial institutions and government portals handling citizen data.
🏢 Affected Saudi Sectors
Government
Banking
Healthcare
Energy
Telecommunications
E-commerce
Education
Media and Publishing
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all WordPress installations using Shortcodes Ultimate plugin versions ≤7.4.10
2. Review user access logs for contributor-level accounts created or modified in past 90 days
3. Scan all pages/posts containing [su_box] shortcodes for suspicious max_width attribute values
4. Disable the plugin immediately if not actively maintained
PATCHING GUIDANCE:
1. Contact plugin developer for security update timeline
2. If update unavailable, deactivate and remove Shortcodes Ultimate plugin
3. Replace functionality with alternative, actively maintained shortcode plugins
4. Test all page rendering after plugin removal
COMPENSATING CONTROLS:
1. Restrict contributor role to trusted users only; audit existing contributors
2. Implement Web Application Firewall (WAF) rules to detect/block XSS patterns in shortcode attributes
3. Enable WordPress security plugins (Wordfence, Sucuri) with XSS detection
4. Implement Content Security Policy (CSP) headers to restrict inline script execution
5. Regular security scanning of WordPress database for malicious shortcode content
DETECTION RULES:
1. Monitor wp_posts table for [su_box] shortcodes with max_width containing script tags or event handlers
2. Alert on any modifications to posts/pages by contributor-level users
3. Log all plugin activation/deactivation events
4. Monitor for unusual JavaScript execution in page contexts
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع تثبيتات WordPress التي تستخدم مكون Shortcodes Ultimate الإصدارات ≤7.4.10
2. مراجعة سجلات الوصول للمستخدمين على مستوى المساهم المُنشأة أو المعدلة في آخر 90 يوماً
3. فحص جميع الصفحات/المنشورات التي تحتوي على اختصارات [su_box] للقيم المريبة في سمة max_width
4. تعطيل المكون فوراً إذا لم يكن قيد الصيانة النشطة
إرشادات التصحيح:
1. التواصل مع مطور المكون لمعرفة جدول تحديث الأمان
2. إذا لم يكن التحديث متاحاً، قم بإلغاء تنشيط وإزالة مكون Shortcodes Ultimate
3. استبدال الوظائف بمكونات اختصار بديلة يتم صيانتها بنشاط
4. اختبار جميع عمليات عرض الصفحات بعد إزالة المكون
الضوابط التعويضية:
1. تقييد دور المساهم للمستخدمين الموثوقين فقط؛ تدقيق المساهمين الحاليين
2. تنفيذ قواعد جدار حماية تطبيقات الويب (WAF) للكشف عن أنماط XSS وحجبها
3. تفعيل مكونات أمان WordPress (Wordfence, Sucuri) مع كشف XSS
4. تنفيذ رؤوس سياسة أمان المحتوى (CSP) لتقييد تنفيذ البرامج النصية المضمنة
5. الفحص الدوري لقاعدة بيانات WordPress للكشف عن محتوى الاختصار الضار
قواعد الكشف:
1. مراقبة جدول wp_posts للاختصارات [su_box] التي تحتوي على max_width يتضمن علامات البرامج النصية أو معالجات الأحداث
2. التنبيه على أي تعديلات على المنشورات/الصفحات من قبل مستخدمي مستوى المساهم
3. تسجيل جميع أحداث تنشيط/إلغاء تنشيط المكون
4. مراقبة تنفيذ JavaScript غير العادي في سياقات الصفحة
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Information security requirements for supplier relationships
ECC 2024 A.5.1.1 - Policies for information security
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
🔵 SAMA CSF
SAMA CSF ID.BE-3.1 - Organizational resilience objectives
SAMA CSF PR.DS-6 - Data is protected from unauthorized access
SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events
🟡 ISO 27001:2022
ISO 27001:2022 A.5.1 - Policies for information security
ISO 27001:2022 A.8.1 - User endpoint devices
ISO 27001:2022 A.14.2 - Supplier relationships
ISO 27001:2022 A.12.6 - Management of technical vulnerabilities
🟣 PCI DSS v4.0.1
PCI DSS 6.5.7 - Cross-site scripting (XSS)
PCI DSS 6.2 - Security patches and updates
PCI DSS 7.1 - Limit access to system components
🔗 References & Sources 4
🔗
🔗
🔗
🔗
https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shor...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.9/includes/shor...
security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate/trunk/includes...
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/61ab7a28-bcca-41ff-89d1-c083c...
security@wordfence.com