ToneDen Shortcode

ToneDen Shortcode has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; none of them are fixed as of August 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, SQL Injection.

None of the 3 issues recorded for ToneDen Shortcode have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by luc. ToneDen Shortcode is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.9.16.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all ToneDen Shortcode vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-28158

Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2026-08-13 00:00	Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting ToneDen Shortcode <= 358	`CVE-2026-28158`	7.2 High	luc	No
2026-08-13 00:00	Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection ToneDen Shortcode <= 358	`CVE-2026-28156`	6.5 Medium	luc	No
2026-08-13 00:00	Do Lasso <= 358 - Unauthenticated Insecure Direct Object Reference ToneDen Shortcode <= 358	`CVE-2026-28155`	5.3 Medium	luc	No

Showing 1–3 of 3 reports

Plugin Profile

Latestv1.0

ToneDen Shortcode

Author

Lasso

0.0(0)

0/100

Last Updated

2022-05-18 (4y ago)

Active Installs

2,000+

Downloads

9,790

Requires WP

3.0.1+

Requires PHP

Tested up to

WP 5.9.16

Created

2016-10-27 (10y ago)

ToneDen is the easiest way to turn anonymous website visitors into real customers. This plugin makes installation of the widget a simple one-step process.

View on WordPress.org