CVE-2024-4553

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_members' shortcode in all versions up to, and including, 7.1.5 due to insufficient input sanitization and output escaping on user supplied 'color' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-455376.5Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted us CVE-2024-455389.6Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-728 CVE-2024-455397.5Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology CVE-2024-45545.4Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Acce CVE-2024-455406.6Memory corruption while invoking IOCTL map buffer request from userspace.CVE-2024-455417.8Memory corruption when IOCTL call is invoked from user-space to read board data.CVE-2024-455427.8Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.CVE-2024-455436.6Memory corruption while accessing MSM channel map and mixer functions.CVE-2024-455446.6Memory corruption while processing IOCTL calls to add route entry in the HW.CVE-2024-455467.8Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space.CVE-2024-455477.8Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.CVE-2024-455487.8Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.