The WP Shortcodes Plugin — Shortcodes Ultimate for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the su_carousel shortcode. This occurs due to improper neutralization of input in the 'su_slide_link' attachment meta field, allowing authenticated users with author-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 7.4.8. No official fix or patch has been released as of the publication date.

An attacker with author-level access or higher can exploit this vulnerability to inject malicious scripts into pages via the su_carousel shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or user session compromise. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or removing the su_carousel shortcode if feasible. Monitor vendor channels for updates and apply patches promptly once available.