JSM file_get_contents() Shortcode

Explore JSM file_get_contents() Shortcode vulnerabilities across all versions. Currently tracking 2 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all JSM file_get_contents() Shortcode vulnerabilities before they are exploited.

Vulnerability Records

2 records


2025-09-22 00:00	JSM file_get_contents() Shortcode <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting JSM file_get_contents() Shortcode <= 2.7.1	`CVE-2025-58653`	6.4 Medium	권민성	No
2023-12-21 00:00	JSM file_get_contents() Shortcode <= 2.7.0 - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode JSM file_get_contents() Shortcode <= 2.7.0	`CVE-2023-6991`	5.4 Medium	Dmitrii Ignatyev	Yes

Showing 1–2 of 2 reports

Latestv2.7.1

JSM file_get_contents() Shortcode

Author

JS Morisset

5.0(1)

100/100

Last Updated

2026-07-20 (10d ago)

Active Installs

300+

Downloads

13,765

Requires WP

6.0+

Requires PHP

7.4.33+

Tested up to

WP 7.0.2

Created

2014-06-22 (12y ago)

A safe and reliable WordPress shortcode for PHP’s file_get_contents() function. Shortcode Attributes body = Keep only the content between <body></body> HTML tags (default is true). cache = Number of seconds to cache the contents (defaults is 3600 seconds). class = Add a class to the content ‘div’ container (default is none). code = Wrap the content in a <code></code> container (default is false). code_class = Add a class to the ‘code’ container (default is none). code_lang = Escape HTML characters, wrap the content in a <pre><code></code></pre> container, and add a language class to the ‘code’ container (default is none). esc_html = Escape HTML characters (default is false). esc_html_pre_code = Escape HTML characters and wrap the content in a <pre><code></code></pre> container (default is false). file = Path to a local file (relative to the wp-content/ folder). filter = Apply the named filter to the content (default is none). more = Add a more link on non-singular web pages (default is true). pre = Wrap the content in a <pre></pre> container (default is false). pre_class = Add a class to the ‘pre’ container (default is none). pre_code = Wrap the content in a <pre><code></code></pre> container (default is false). pre_lang = Escape HTML characters, wrap the content in a <pre><code></code></pre> container, and add a language class to the ‘pre’ container (default is none). pre_title = Add a title to the ‘pre’ container (default is none). url = URL or file URI. utf8 = Encode HTML entities (default is true). Note that all file paths (not URLs) are relative to the wp-content/ folder. For security reasons, it is not possible to include files outside the wp-content/ folder. As an example, the shortcode attributes url="file://dir/file.html" and file="/dir/file.html" are both read as wordpress/wp-contents/dir/file.html. The .. folder name is also stripped from file paths to prevent backing out of the wp-content/ folder. Shortcode Name The WPFGC_SHORTCODE_NAME constant can be defined in your wp-config.php file to add an additional custom shortcode name (the default shortcode names are ‘wp-file-get-contents’ and ‘wpfgc’). define( 'WPFGC_SHORTCODE_NAME', 'include' ); Shortcode Examples [wpfgc url="http://example.com/dir/file.html"] [wpfgc url="http://example.com/counter/" cache="7200"] [wpfgc url="file://dir/file.html"] [wpfgc file="/dir/file.txt" pre="true" filter="my_custom_filter_name" cache="600"] [wpfgc file="examples/example-1.php" code_lang="php"]

View on WordPress.org