The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its su_lightbox shortcode. This vulnerability is due to improper neutralization of user-supplied input during web page generation, specifically lacking sufficient sanitization and escaping of shortcode attributes. Authenticated users with contributor or higher privileges can exploit this to inject malicious scripts that execute in the context of other users viewing the affected pages. The vulnerability affects all versions up to 7.1.6. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity with no impact on availability. No patch or remediation details are currently available from the vendor.

Successful exploitation allows an authenticated contributor-level or higher user to inject persistent malicious scripts into pages via the su_lightbox shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to partial confidentiality and integrity loss such as session hijacking or defacement. There is no reported impact on availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the su_lightbox shortcode functionality if feasible. Monitor official vendor channels for updates and apply patches promptly once available.