Credits Shortcode & Block
Credits Shortcode & Block has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Credits Shortcode & Block has a vendor fix available, so running the current release closes it.
All of these findings were reported by MAJidox. Credits Shortcode & Block is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-6256Credits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Read the full analysisVulnerability Records

Credits Shortcode & Block
Author
jashjacob
Give readers a clear path back to the original source. Credits Shortcode & Block adds compact, theme-friendly Source or Via attribution links to WordPress posts and pages. Highlights Native Gutenberg block with a live editor preview. Simple [credits] shortcode for any post, page, or widget area. Site-wide defaults under Settings > Credits. Optional colors for the badge, link background, and link text. Compact, standard, or spacious gaps between consecutive credits. Classic Editor toolbar button for legacy workflows. Responsive, theme-friendly output with subtle hover feedback. Translation-ready and compatible with WordPress multisite. No external service, account, tracking, or front-end JavaScript. Gutenberg Block Open a post or page in the Block Editor. Add the Credits Link block by clicking + or typing /credits. Choose Source or Via, enter the attribution name, and add its URL. Optionally choose accent colors in the block sidebar. The block is rendered dynamically, so saved content stays clean and current. Shortcode Basic source attribution: [credits link="https://example.com"]Source Name[/credits] Via attribution: [credits link="https://example.com" type="via"]Publication Name[/credits] Using a name attribute: [credits name="Source Name" link="https://example.com"] Custom colors: [credits link="https://example.com" type="source" badge_color="#0073aa" link_color="#f0f0f0" link_text_color="#0073aa"]Source Name[/credits] Supported attributes: name – attribution text; inner shortcode content takes precedence. link – destination URL. type – source or via. badge_color – badge background as a 3- or 6-digit hex color. link_color – link area background as a 3- or 6-digit hex color. link_text_color – link text as a 3- or 6-digit hex color. spacing – compact, standard, or spacious; defaults to the site-wide setting. To keep several credits close together: [credits link="https://example.com" spacing="compact"]Source Name[/credits] Site-wide Defaults Go to Settings > Credits to choose the default credit type, spacing, and optional accent colors. Individual blocks and shortcodes can override those defaults.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C