The [su_box] shortcode of Shortcodes Ultimate concatenated its max_width attribute straight into the wrapper element’s inline style attribute without any escaping. A contributor-level user could therefore close the attribute and store arbitrary HTML and JavaScript in a post, which then executes in the browser of every visitor or administrator who opens the page. Version 7.5.0 fixes this by passing max_width through the new su_sanitize_css_value() allowlist helper and escaping the result with esc_attr().
This vulnerability affects the following application versions:
- Shortcodes Ultimate – Content Elements 5.13.2
- Shortcodes Ultimate – Content Elements 5.13.3
- Shortcodes Ultimate – Content Elements 7.0.0
- Shortcodes Ultimate – Content Elements 7.0.1
- Shortcodes Ultimate – Content Elements 7.0.2
- Shortcodes Ultimate – Content Elements 7.0.3
- Shortcodes Ultimate – Content Elements 7.0.4
- Shortcodes Ultimate – Content Elements 7.0.5
- Shortcodes Ultimate – Content Elements 7.1.0
- Shortcodes Ultimate – Content Elements 7.1.2
- Shortcodes Ultimate – Content Elements 7.1.3
- Shortcodes Ultimate – Content Elements 7.1.4
- Shortcodes Ultimate – Content Elements 7.1.5
- Shortcodes Ultimate – Content Elements 7.1.6
- Shortcodes Ultimate – Content Elements 7.1.7
- Shortcodes Ultimate – Content Elements 7.1.8
- Shortcodes Ultimate – Content Elements 7.2.1
- Shortcodes Ultimate – Content Elements 7.2.2
- Shortcodes Ultimate – Content Elements 7.3.0
- Shortcodes Ultimate – Content Elements 7.3.1
- Shortcodes Ultimate – Content Elements 7.3.2
- Shortcodes Ultimate – Content Elements 7.3.3
- Shortcodes Ultimate – Content Elements 7.3.4
- Shortcodes Ultimate – Content Elements 7.3.5
- Shortcodes Ultimate – Content Elements 7.4.0
- Shortcodes Ultimate – Content Elements 7.4.1
- Shortcodes Ultimate – Content Elements 7.4.2
- Shortcodes Ultimate – Content Elements 7.4.3
- Shortcodes Ultimate – Content Elements 7.4.4
- Shortcodes Ultimate – Content Elements 7.4.5
- Shortcodes Ultimate – Content Elements 7.4.6
- Shortcodes Ultimate – Content Elements 7.4.7
- Shortcodes Ultimate – Content Elements 7.4.8
- Shortcodes Ultimate – Content Elements 7.4.9