{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7369", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-08T19:18:27.435Z", "datePublished": "2025-07-21T07:23:25.011Z", "dateUpdated": "2026-04-08T16:54:43.933Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:43.933Z"}, "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.\r\nIn combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting."}], "title": "Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/inc/core/generator.php#L339"}, {"url": "https://plugins.trac.wordpress.org/changeset/3328729/"}, {"url": "https://research.cleantalk.org/cve-2025-7369/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-07-07T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-07-08T19:34:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-20T19:03:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-21T17:41:55.597431Z", "id": "CVE-2025-7369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T17:42:04.985Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-21T17:41:55.597431Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T17:41:59.932Z"}}], "cna": {"title": "Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-07T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-07-08T19:34:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-20T19:03:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/inc/core/generator.php#L339"}, {"url": "https://plugins.trac.wordpress.org/changeset/3328729/"}, {"url": "https://research.cleantalk.org/cve-2025-7369/"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.\r\nIn combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:43.933Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7369", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:43.933Z", "dateReserved": "2025-07-08T19:18:27.435Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-21T07:23:25.011Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.\r\nIn combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting."}, {"lang": "es", "value": "El complemento WP Shortcodes Plugin \u2014 Shortcodes Ultimate para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 7.4.2 incluida. Esto se debe a la falta o a una validaci\u00f3n de nonce incorrecta en la funci\u00f3n de vista previa. Esto permite que atacantes no autenticados ejecuten shortcodes arbitrarios mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. En combinaci\u00f3n con CVE-2025-7354, provoca Cross-Site Scripting reflejado."}], "id": "CVE-2025-7369", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-21T08:15:24.900", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/inc/core/generator.php#L339"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3328729/"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-7369/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:54:45.015036+00:00", "value": {"mitigation_remediation": ["Upgrade the Shortcodes Ultimate plugin to the latest available version (\u2265\u202f7.4.3 or newer) so the nonce check is restored.", "If an upgrade is not immediately possible, disable the preview feature or otherwise restrict the ability for users to send preview requests that bypass nonce validation.", "Monitor the site for unexpected administrator requests or execution of unfamiliar shortcodes, and consider blocking or logging such activity as an additional safeguard."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress sites installing Shortcodes Ultimate versions up to and including 7.4.2 are affected. The vulnerability is present in all builds of the plugin before the latest release that addresses the nonce validation bug. Site administrators using older plugin versions must be aware that any recruited admin click can trigger code execution.", "description_and_impact": "The WP Shortcodes Plugin \u2013 Shortcodes Ultimate suffers from a missing or incorrect nonce check on its preview function. This flaw enables an unauthenticated attacker to craft a forged request that an administrator might click, causing the site to execute any shortcode the attacker supplies. In combination with the related CVE\u20112025\u20117354, the vulnerability also permits reflected cross\u2011site scripting. The weakness is a classic Cross\u2011Site Request Forgery problem (CWE\u2011352).", "risk_and_exploitability": "The CVSS score of 6.1 marks the issue as moderate severity. With an EPSS score of less than 1\u202f% the probability of an immediate exploit is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure a privileged user to click a crafted link, meaning that while the impact could be severe, the exploitation vector requires user interaction and is limited to sites with the vulnerable plugin installed."}}}}, "created": "2026-04-21T04:00:10.060354+00:00", "updated": "2026-04-21T04:00:10.060365+00:00", "vendors": []}