JSM Screenshot Machine Shortcode
JSM Screenshot Machine Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for JSM Screenshot Machine Shortcode has a vendor fix available, so running the current release closes it.
All of these findings were reported by SOPROBRO. JSM Screenshot Machine Shortcode is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-13385JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

JSM Screenshot Machine Shortcode
Author
JS Morisset
Shortcode to include images from Screenshot Machine in your content. SSM Shortcode Required Attributes: key="{customer API key}" url="{webpage url}" You can find the {customer API key} in your Screenshot Machine dashboard. The {webpage url} is the web page URL you want to capture in the screenshot. SSM Shortcode Optional Attributes: dimension="{width x height}" (default is 120×90) device="{desktop|phone|tablet}" (default is desktop) format="{jpg|png|gif}" (default is jpg) days="{cache expiration}" (default is 14) wait="{ms}" (default is 200) zoom="{percentage}" (default is 100) click="{css selector}" (example: .button-close) hide="{css selectors}" (example: .add-banner1,.add-banner2) cookies="{semicolon list}" (example: name1=value1;name2=value2) language="{locale}" (example: en-US) agent="{user agent}" select="{css selector}" (example: table.table:nth-child(3) > tbody:nth-child(2) > tr:nth-child(15)) crop="{x,y,width,height}" (example: 100,0,800,300) title="{title}" link="{yes|no}" (default is yes) target="{name}" (default is _blank) refresh="{yes|no}" (default is yes) SSM Shortcode Attribute Details: The dimension=”{width x height}” attribute examples: dimension="320x240" – screenshot size 320×240 pixels. dimension="800x600" – screenshot size 800×600 pixels. dimension="1024x768" – screenshot size 1024×768 pixels. dimension="1920x1080" – screenshot size 1920×1080 pixels. dimension="1024xfull" – full page screenshot with width equals to 1024 pixels (can be pretty long). The days=”{cache expiration}” attribute value is a number of days that a screenshot should be used before a new one is created (default is 14). The wait=”{ms}” attribute value is a number of milliseconds to wait before capturing the screenshot (default is 200). The click=”{css selector}”, hide=”{css selectors}”, and select=”{css selector}” attribute values are CSS class and/or id selectors. For example: click=".button-close" – click this CSS class container before taking a screenshot. hide=".add-banner1,.add-banner2" – hide this CSS class container before taking a screenshot. select="table.table:nth-child(3) > tbody:nth-child(2) > tr:nth-child(15)" – take a screenshot only of this CSS container. The title=”{title}” attribute value is a text string for the image alt and anchor title attributes. The link=”{yes|no}” attribute value will determine if the image is linked to the web page URL or not. The target=”{name}” attribute opens the link in that target (default is “_blank”). An empty string, “_self”, “_top”, “_parent”, or an HTML frame are other possible values. The refresh=”{yes|no}” attribute value includes javascript to retry the image every second until it’s available (for a maximum of 10 seconds). SSM Shortcode Example: [ssm key="abc123" url="https://google.com/" dimension="800x600"]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C