Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-3885 Stored Cross-Site Scripting in WP Shortcodes Plugin Shortcodes Ultimate 7.4.9 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3885
Post summary
The statement reports a stored XSS flaw (CVE‑2026‑3885) in Shortcodes Ultimate 7.4.9, but offers no PoC, exploit code, evidence of active use, or patch information.
CVE-2026-3885 The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up … https://www.cve.org/CVERecord?id=CVE-2026-3885
Post summary
The post discloses a stored XSS vulnerability (CVE‑2026‑3885) affecting every version of the Shortcodes Ultimate WordPress plugin through the 'su_box' shortcode. No PoC, exploit code, active exploitation, or patch information is included.