CVE-2026-0737

Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 35,185 live websites that are affected by CVE-2026-0737.

Run a Free Instant Scan



Affected Software

Product  Shortcodes Ultimate
Category Widgets
Vulnerable Domains35,185 live websites (61% of Shortcodes Ultimate install base)
Vulnerable Versions
  • from 0 through 7.4.7
Vulnerable Versions Count104 versions ( 97% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Apr 4, 2026
  • Updated - Apr 8, 2026

Credits

  • Dmitrii Ignatyev (finder)

Website Distribution by Country

Number of websites using CVE-2026-0737
United States8,637 websites


Japan4,759 websites
Germany3,914 websites
Russia3,275 websites
France1,891 websites
Italy1,136 websites
Poland1,092 websites
GB994 websites
Spain746 websites
Netherlands636 websites

Website Distribution by TLD

Number of websites using CVE-2026-0737
.com13,263 websites
.ru2,685 websites
.de2,568 websites
.org1,890 websites
.net1,187 websites
.jp1,119 websites
.fr960 websites
.pl818 websites
.it781 websites
.co.jp644 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-0737

Top websites that are affected by CVE-2026-0737. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.com United States*,***
***.com United States*,***
***********.net United States**,***
*************.com United States**,***
******.com United States**,***
*********.com United States**,***
*****.org United States**,***
******.com United States**,***
**********.com United States**,***
******.eu United States**,***
See full domain list

FAQ

CVE-2026-0737 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Shortcodes Ultimate
A total of 35,185 websites have been identified as vulnerable to CVE-2026-0737, based on global website indexing conducted by WebTechSurvey.
The Shortcodes Ultimate is affected by the CVE-2026-0737 vulnerability.
Shortcodes Ultimate versions up to and including 7.4.7 are vulnerable to CVE-2026-0737.