The WP Shortcodes Plugin — Shortcodes Ultimate for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'su_members' shortcode. The issue arises because the plugin does not properly sanitize or escape the 'color' attribute provided by users, allowing authenticated contributors or higher to inject arbitrary JavaScript code. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 7.1.5 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No official patch or vendor advisory is currently provided in the data.

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject persistent malicious scripts into pages using the 'su_members' shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure (partial confidentiality impact) and integrity loss (partial integrity impact). Availability is not affected. The vulnerability enables cross-site scripting attacks that can compromise user sessions or perform unauthorized actions within the context of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'su_members' shortcode if possible to prevent exploitation. Monitor for plugin updates from gn_themes addressing this vulnerability.