Shortcode

Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Shortcode has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Muhammad Yudha - DJ. Shortcode is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.2.39.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all Shortcode vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-58022

Shortcode <= 0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2025-09-22 00:00	Shortcode <= 0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Shortcode <= 0.8.1	`CVE-2025-58022`	6.4 Medium	Muhammad Yudha - DJ	No

Showing 1–1 of 1 reports

Plugin Profile

Latestv0.8.1

Shortcode

Author

maxpagels

0.0(0)

0/100

Last Updated

2016-04-17 (11y ago)

Active Installs

500+

Downloads

38,606

Requires WP

2.5+

Requires PHP

Tested up to

WP 4.2.39

Created

2009-08-12 (17y ago)

Shortcode is a plugin that adds several useful shortcodes that you can use in your blog posts and pages. Updated frequently with more shortcodes. Feedback Like the plugin? Hate it? Want a new feature? Send me some feedback — no email address or registration needed.

View on WordPress.org