CVE-2025-7369: Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Shortcodes Ultimateto a version that resolves this vulnerability.Fixed in 7.4.2 - Compensating control
Mitigate the CSRF issue by preventing untrusted users from being able to trigger the Shortcodes Ultimate preview action via forged requests (e.g., restrict/lock down the ability for site administrators to click attacker-controlled links while the vulnerability is present).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7369?
CVE-2025-7369 has a medium severity rating due to its potential to facilitate Cross-Site Request Forgery attacks.
How do I fix CVE-2025-7369?
To mitigate CVE-2025-7369, update the WP Shortcodes Plugin — Shortcodes Ultimate to version 7.4.3 or later.
Who is affected by CVE-2025-7369?
Users of the WP Shortcodes Plugin — Shortcodes Ultimate in versions up to and including 7.4.2 are affected by CVE-2025-7369.
What type of vulnerability is CVE-2025-7369?
CVE-2025-7369 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Is authentication required to exploit CVE-2025-7369?
No, CVE-2025-7369 can be exploited by unauthenticated attackers due to insufficient nonce validation.