The WP Shortcodes Plugin - Shortcodes Ultimate (up to version 7.4.8) contains a stored cross-site scripting vulnerability (CWE-79) in the su_carousel shortcode. This issue is due to improper neutralization of input in the 'su_slide_link' attachment meta field, allowing authenticated users with author-level privileges or higher to inject malicious scripts. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is network exploitable with low attack complexity and does not require user interaction beyond viewing the injected page. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting limited confidentiality and integrity impact but no availability impact. No vendor patch or official fix has been documented yet.

An authenticated attacker with author-level access or above can inject and store malicious scripts via the su_carousel shortcode's 'su_slide_link' field. These scripts execute in the browsers of users who visit the compromised pages, potentially allowing theft of session tokens, defacement, or other script-based attacks affecting confidentiality and integrity. The vulnerability does not impact system availability. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or removing the su_carousel shortcode if feasible. Monitor for plugin updates from gn_themes and apply them promptly once available.