Last Updated Shortcode
Last Updated Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Last Updated Shortcode has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Yudha - DJ. Last Updated Shortcode is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.
CVE-2025-58683Last Updated Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Last Updated Shortcode
Author
Luke Mlsna
Creates the [lastupdated] shortcode to display the date and/or time of the last update to a post or page. If used without any arguments, it will display the date in the format configured in the Settings > General tab. It supports several optional arguments: format, before, and after. These options allow you to change how the date/time is formatted and if anything should appear before or after the date/time is displayed. Readme Generator This plugin’s readme.txt file was generated by the bitacre Readme Generator for WordPress Plugins. Support Plugin Homepage plugins@shinraholdings.com Donations Donations are graciously accepted to support the continued development and maintenance of this and other plugins. We currently accept Paypal and kind words.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C