WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Shortcodes Ultimate – Content Elements

Add 50+ shortcodes with live preview for tabs, accordions, buttons, FAQs, sliders and boxes. Works in Block Editor and Classic Editor.

36Reported vulnerabilities
9.8Highest CVSS score
7.8.4Latest version
400,000+Active installs

What to do now

Update Shortcodes Ultimate – Content Elements to 7.5.0 or later. 36 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days
Affected versionsFixed inPublished
CVE-2025-0370 Medium 5.4 35.6% Before 7.3.4 7.3.4 March 4, 2025
CVE-2017-18580 Critical 9.8 12.1% Before 5.0.1 5.0.1 August 22, 2019
CVE-2023-0911 Medium 6.5 0.7% Before 5.12.8 5.12.8 March 20, 2023
CVE-2023-0890 Medium 6.5 0.7% Before 5.12.8 5.12.8 March 20, 2023
CVE-2024-3188 Medium 6.3 0.4% Before 7.1.0 7.1.0 April 26, 2024
CVE-2024-3548 Medium 6.1 0.4% Before 7.1.2 7.1.2 May 15, 2024
CVE-2024-2583 Medium 5.4 0.4% Before 7.0.5 7.0.5 April 13, 2024
CVE-2023-6225 Medium 5.4 0.5% Before 7.0.0 7.0.0 November 28, 2023
CVE-2021-24525 Medium 5.4 0.6% Before 5.10.2 5.10.2 September 20, 2021
CVE-2022-41136 High 8.8 0.3% 5.12.0 and earlier 5.12.1 November 8, 2022
CVE-2023-6226 Medium 4.3 0.5% Before 7.0.0 7.0.0 November 28, 2023
CVE-2023-25050 Medium 6.5 0.6% 5.12.6 and earlier 5.12.7 February 10, 2023
CVE-2026-3885 Medium 6.4 0.3% 0 to 7.4.9 (inclusive) 7.5.0 April 16, 2026
CVE-2026-0737 Medium 6.4 0.3% 0 to 7.4.7 (inclusive) 7.4.8 April 4, 2026
CVE-2026-0738 Medium 6.4 0.3% 7.4.8 and earlier 7.4.9 April 3, 2026
CVE-2025-7354 Medium 6.4 0.3% 0 to 7.4.2 (inclusive) 7.4.3 July 21, 2025
CVE-2023-23800 Medium 6.5 0.5% 5.12.6 and earlier 5.12.7 February 10, 2023
CVE-2026-2480 Medium 6.4 0.2% 0 to 7.4.10 (inclusive) 7.5.0 March 31, 2026
CVE-2025-12800 Medium 6.4 0.2% 7.4.5 and earlier 7.4.6 November 23, 2025
CVE-2025-8015 Medium 6.4 0.2% 0 to 7.4.2 (inclusive) 7.4.3 July 22, 2025
CVE-2025-49244 Medium 6.4 0.2% 7.3.5 and earlier 7.4.0 June 5, 2025
WF-2ac1d65c-5e09-41ca-809b-2ab3ab5f62af Medium 6.4 5.12.0 and earlier 5.12.1 October 13, 2022
CVE-2025-7369 Medium 6.1 0.2% 0 to 7.4.2 (inclusive) 7.4.3 July 21, 2025
WF-baa720d6-1891-4557-a744-830be56862e9 Medium 6.1 4.9.3 and earlier 4.9.4 May 5, 2015
CVE-2017-2245 Medium 5 2.6% Before 4.10.0 4.10.0 June 23, 2017
CVE-2024-8500 Medium 5.4 0.4% Before 7.3.0 7.3.0 October 23, 2024
CVE-2024-4821 Medium 5.4 0.3% Before 7.1.7 7.1.7 June 5, 2024
CVE-2024-4553 Medium 5.4 0.3% Before 7.1.6 7.1.6 May 21, 2024
CVE-2024-3550 Medium 5.4 0.6% Before 7.1.3 7.1.3 May 2, 2024
CVE-2024-0792 Medium 5.4 0.4% Before 7.0.2 7.0.2 February 29, 2024
CVE-2024-1808 Medium 5.4 0.3% Before 7.0.4 7.0.4 February 28, 2024
CVE-2024-1510 Medium 5.4 0.5% Before 7.0.3 7.0.3 February 20, 2024
CVE-2023-6488 Medium 5.4 0.5% 7.0.0 and earlier 7.0.1 December 19, 2023
CVE-2023-25040 Medium 5.4 0.4% Before 5.12.7 5.12.7 March 30, 2023
CVE-2025-5567 Medium 5.4 0.2% Before 7.4.1 7.4.1 July 4, 2025
CVE-2022-38086 Medium 4.3 0.3% 5.12.0 and earlier 5.12.1 October 11, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.