Extra Shortcodes

Extra Shortcodes has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Extra Shortcodes has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Muhammad Yudha - DJ. Extra Shortcodes is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Extra Shortcodes vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-62111

Extra Shortcodes <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv2.2

Extra Shortcodes

webvitalii

Author

webvitalii

4.1(10)
82/100
Last Updated
2023-04-13 (4y ago)
Active Installs
1,000+
Downloads
17,511
Requires WP
3.0+
Requires PHP
0+
Tested up to
WP 6.2.11
Created
2012-01-08 (15y ago)

WordPress Pro plugins Extra Shortcodes Donate GitHub Shortcodes: [extra_archives] – list of monthly archives links sorted by date; [extra_archives type="yearly"] – list of yearly archives links; [extra_archives type="monthly"] – list of monthly archives links; [extra_archives type="weekly"] – list of weekly archives links; [extra_archives type="daily"] – list of daily archives links; [extra_archives type="postbypost"] – list of all posts links sorted by date; [extra_archives type="alpha"] – list of all posts links sorted by title; [extra_taxonomies] – list of categories, tags or any other taxonomies; [bloginfo show="name"] – bloginfo params; [date format="l jS \\of F Y h:i:s A"] – Monday 23rd April 2012 09:37:57 AM; php date format params; [date format="l jS \\of F Y h:i:s A" timestamp="+2 years +3 months -20 days -10 hours +30 minutes"] – Thursday 3rd July 2014 06:52:57 AM; relative datetime formats; [date format="h:i:s A" use_wordpress_timezone="1"] – use WordPress timezone from Settings section; [date_i18n format="l jS \\of F Y h:i:s A" timestamp="+2 years +3 months -20 days -10 hours +30 minutes"] – Четвер, 3 Липня 2014 06:52:57; shortcode based on date_i18n; [time format="h:i:s A"] – 01:35:08 PM; php time format params; [year] – 2012, [year plus="3"] – 2015, [year minus="2"] – 2010; [month] – 4 (in April), [month plus="10"] – 2, [month minus="8"] – 8; [month_name] – April, [month_name plus="10"] – February, [month_name minus="8"] – August; [day] – 8, [day plus="3"] – 11, [day minus="2"] – 6; [weekday] – Monday, [weekday plus="5"] – Saturday, [weekday minus="5"] – Wednesday; [hours], [minutes], [seconds]; more info about shortcodes Useful: “Page-list” – show list of pages with shortcodes “Iframe” – embed content WordPress Pro plugins Parameters for [extra_archives]: [extra_archives] – list of monthly archives links sorted by date; [extra_archives type="yearly"] – list of yearly archives links; [extra_archives type="monthly"] – list of monthly archives links; [extra_archives type="weekly"] – list of weekly archives links; [extra_archives type="daily"] – list of daily archives links; [extra_archives type="postbypost"] – list of all posts links sorted by date; [extra_archives type="alpha"] – list of all posts links sorted by title; limit – how many links to be included in the list: [extra_archives limit="10"]; by default all links are shown: [extra_archives limit=""]; show_post_count – display counter of posts in the archive: [extra_archives show_post_count="1"]; by default counter is not shown: [extra_archives show_post_count="0"]; order – how to sort archives links: [extra_archives order="ASC"]; by default links are sorted by descending order (Z-A): [extra_archives order="DESC"]; [extra_archives] is based on wp_get_archives function. Parameters for [extra_taxonomies]: orderby – sort list by specific field: [extra_taxonomies order="count"]; by default list is sorted by name: [extra_taxonomies order="name"]; possible values: ID, name, slug, count, term_group; order – the sort order of the list of pages (either ascending or descending): [extra_taxonomies order="DESC"]; by default: [extra_taxonomies order="ASC"]; possible values: ASC, DESC; show_count – display counter of posts in the list: [extra_taxonomies show_count="1"]; by default counter is not shown: [extra_taxonomies show_count="0"];* limit – how many links to be included in the list: [extra_archives limit="10"]; by default all links are shown: [extra_archives limit=""]; hide_empty – show or hide empty categories or taxonomies: [extra_taxonomies hide_empty="0"]; by default empty categories are hidden: [extra_taxonomies hide_empty="1"]; use_desc_for_title – use description for title: [extra_taxonomies use_desc_for_title="0"]; by default the description is used as link title: [extra_taxonomies use_desc_for_title="1"]; child_of – only display categories that are children of the category identified by this parameter: [extra_taxonomies child_of="77"]; exclude – exclude one or more categories (comma-separated list of category ids) from the results: [extra_taxonomies exclude="5,7,9"]; exclude_tree – exclude category-tree (comma-separated list of category ids) from the results: [extra_taxonomies exclude_tree="5,7,9"]; The parameter include must be empty. If the hierarchical parameter is true, then use exclude instead of exclude_tree. include – only include the categories detailed in a comma-separated list by category id: [extra_taxonomies include="5,7,9"]; hierarchical – list is hierarchical (tree-like) or flat: [extra_taxonomies hierarchical="0"]; by default the list is hierarchical: [extra_taxonomies hierarchical="1"]; number – sets the number of categories to display: [extra_taxonomies number="10"]; by default the number is unlimited: [extra_taxonomies number=""]; depth – how many levels in the hierarchy of pages are to be included in the list: [extra_taxonomies depth="3"]; by default the depth is unlimited: [extra_taxonomies depth="0"]; taxonomy – show list of registered taxonomy: [extra_taxonomies taxonomy="post_tag"]; by default shows the list of categories: [extra_taxonomies taxonomy="category"]; [extra_taxonomies] is based on wp_list_categories function. Parameters for [bloginfo]: [bloginfo show="name"] – bloginfo params; [site_name] – Name of the site; [site_desc] – Description of the site; [site_url] – http://site.url; [wp_version] – 4.5 (WordPress version); [bloginfo] is based on bloginfo function. Parameters for [date]: [date format="l jS \\of F Y h:i:s A"] – Monday 23rd April 2012 09:37:57 AM; php date format params; [date format="l jS \\of F Y h:i:s A" timestamp="+2 years +3 months -20 days -10 hours +30 minutes"] – Thursday 3rd July 2014 06:52:57 AM; relative datetime formats; [date format="h:i:s A" use_wordpress_timezone="1"] – use WordPress timezone from Settings section; [date_i18n format="l jS \\of F Y h:i:s A" timestamp="+2 years +3 months -20 days -10 hours +30 minutes"] – Четвер, 3 Липня 2014 06:52:57; shortcode based on date_i18n; [time format="h:i:s A"] – 01:35:08 PM; php time format params; [year] – 2012, [year plus="3"] – 2015, [year minus="2"] – 2010; [month] – 4 (in April), [month plus="10"] – 2, [month minus="8"] – 8; [month_name] – April, [month_name plus="10"] – February, [month_name minus="8"] – August; [day] – 8, [day plus="3"] – 11, [day minus="2"] – 6; [weekday] – Monday, [weekday plus="5"] – Saturday, [weekday minus="5"] – Wednesday; [hours], [minutes], [seconds];

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C