CVE-2026-0738

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?old_path=shortcodes-ultimate/tags/7.4.8/includes/shortcodes/carousel.php&new_path=shortcodes-ultimate/tags/7.4.9/includes/shortcodes/carousel.php
• https://research.cleantalk.org/cve-2026-0738/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=cve

Published

Apr 4, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0732A vulnerability was found in D-Link DI-8200G 17.12.20A1. Thi…9.8
• CVE-2026-0733A vulnerability was determined in PHPGurukul Online Course R…8.8
• CVE-2026-0734The WP Allowed Hosts plugin for WordPress is vulnerable to S…4.4
• CVE-2026-0735The User Language Switch plugin for WordPress is vulnerable …4.4
• CVE-2026-0736The Chatbot for WordPress by Collect.chat plugin for WordPre…6.4
• CVE-2026-0737The WP Shortcodes Plugin - Shortcodes Ultimate plugin for Wo…6.4
• CVE-2026-0739The WMF Mobile Redirector plugin for WordPress is vulnerable…4.4
• CVE-2026-0740The Ninja Forms - File Uploads plugin for WordPress is vulne…9.8
• CVE-2026-0741The Electric Studio Download Counter plugin for WordPress is…4.4
• CVE-2026-0742The Smart Appointment & Booking plugin for WordPress is vuln…6.4
• CVE-2026-0743The WP Content Permission plugin for WordPress is vulnerable…4.4
• CVE-2026-0745The User Language Switch plugin for WordPress is vulnerable …5.5