CVE-2026-2480: 
WordPress vulnerability analysis and mitigation

CVE-2026-2480 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress, affecting all versions up to and including 7.4.10. The flaw exists in the max_width attribute of the su_box shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on March 31, 2026, with a patch advisory added to the GitHub Advisory Database on April 1, 2026. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the box.php shortcode handler fails to properly sanitize or escape the max_width attribute before rendering it in page output, allowing arbitrary JavaScript to be embedded in the stored HTML. An authenticated attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [su_box max_width="..."] shortcode, and the injected script executes in the browsers of any user who subsequently views that page. Relevant vulnerable code is located in includes/shortcodes/box.php at lines 107 and 113 of the 7.4.9 tag (GitHub Advisory).

Successful exploitation allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors without any additional user interaction. This can result in session hijacking, credential theft, unauthorized data exfiltration, and defacement of page content. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the site (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.03–0.045%, placing it in the 14th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account (contributor or above), which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify a WordPress site running WP Shortcodes Plugin — Shortcodes Ultimate version 7.4.10 or earlier. This can be done by checking the plugin version in the site's /wp-content/plugins/shortcodes-ultimate/readme.txt or via passive enumeration tools.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a payload such as [su_box max_width="1px\" onmouseover=\"alert(document.cookie)\""]Content[/su_box] or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
4. Publish the page: Submit the post for review or publish it directly (depending on role permissions), causing the malicious attribute to be stored in the WordPress database.
5. Trigger execution: When any authenticated or unauthenticated user visits the injected page, the browser renders the unsanitized max_width attribute and executes the embedded JavaScript, enabling session hijacking or further attacks (GitHub Advisory).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing su_box shortcode content with unusual max_width values (e.g., containing quotes, angle brackets, or JavaScript keywords).
• Database: Suspicious entries in the wp_posts table where post_content contains su_box shortcodes with max_width attributes embedding script tags, event handlers (e.g., onmouseover, onerror), or encoded JavaScript.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing su_box shortcodes, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to includes/shortcodes/box.php if an attacker has escalated to file-write access following initial XSS exploitation.

Update the WP Shortcodes Plugin — Shortcodes Ultimate to a version newer than 7.4.10 that includes the security fix for the su_box shortcode's max_width attribute sanitization (GitHub Advisory). The patch is tracked in the WordPress plugin repository changeset 3489360. As interim mitigations: restrict contributor-level access to only fully trusted users; implement Content Security Policy (CSP) headers to reduce XSS impact; and audit existing posts and pages for suspicious su_box shortcode attributes, particularly any max_width values containing script-like content.

The vulnerability was noted by Wordfence in their threat intelligence database and received standard aggregation coverage from vulnerability tracking services including VulDB, CIRCL, ENISA EUVD, and cvefeed.io. No significant researcher commentary, vendor statements beyond the patch, or notable media coverage has been identified for this moderate-severity vulnerability (GitHub Advisory).