The Shortcodes Ultimate plugin for WordPress has a security issue in versions up to 5.12.0. Attackers could potentially make changes to a preset and inject malicious JavaScript without being authenticated. This could happen if a site administrator is tricked into clicking on a link.