Display During Conditional Shortcode
Display During Conditional Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Display During Conditional Shortcode has a vendor fix available, so running the current release closes it.
All of these findings were reported by Gilang - DJ. Display During Conditional Shortcode is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-6460Display During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter
Read the full analysisVulnerability Records

Display During Conditional Shortcode
Author
Gabriel Serafini
Display content conditionally based on a schedule. Choose from three scheduling modes: Date Range – Show content between specific start and end dates Recurring – Show content on specific days of the week during a time window Custom – Use PHP strtotime expressions for flexible scheduling Gutenberg Block The Display During block provides a visual editor with: Sidebar controls for all three scheduling modes Date/time pickers for start and end dates Day-of-week checkboxes for recurring schedules Live status indicator (active/inactive) Optional fallback message when content is hidden Copy as Shortcode toolbar button Shortcodes The [display_during] shortcode works in the Classic Editor and anywhere shortcodes are supported. Date range: [display_during start_day_time=”June 1, 2026 8:00 am” end_day_time=”December 31, 2026 11:59 pm”]Content here[/display_during] Recurring schedule (new in 2.0): [display_during days=”mon,wed,fri” start_time=”09:00″ end_time=”17:00″]Office hours content[/display_during] Custom strtotime: [display_during start_day_time=”Sun 8:00 am” end_day_time=”Mon 8:00 pm”]Weekend content[/display_during] With fallback message: [display_during end_day_time=”June 1, 2026″]Register now![display_during_message]Registration has closed.[/display_during_message][/display_during] Shortcode Parameters start_day_time – When to start showing content (strtotime string or date) end_day_time – When to stop showing content days – Comma-separated days for recurring mode (mon,tue,wed,thu,fri,sat,sun) start_time – Start time for recurring mode (HH:MM format) end_time – End time for recurring mode (HH:MM format) timezone_location – PHP timezone identifier (defaults to site timezone) message – Plain text fallback message (legacy; use nested shortcode for rich content)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C