CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl quiz AJAX...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Passakorn Yookindee in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-92798

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

EUVD-2026-103233

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-92798 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

PT-2026-116363

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description Insufficient input sanitization in the referrer url branch of the UR Smart Tags::process function allows unauthenticated attackers to execute arbitrary registered shortcodes. T...

CVE-2026-92798: Improper Control of Generation of Code

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

EUVD-2026-102825

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress (versions up to and including 4.17.5 ) is vulnerable to Arbitrary Shortcode Execution . The root cause lies in the get_user_profile_structure() function, which assembles a front-end profile buffer containing raw comment excerpts from author_c...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin ProfilePress versions = 4.17.5...

CVE-2026-15222 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...

EUVD-2026-102801

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...

CVE-2026-15222

The User Registration & Membership plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 5.2.8 . The root cause is a failure to properly validate values before processing the do_shortcode function. This allows authenticated attackers with subscrib...

CVE-2026-104001 Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-104001

The Slim SEO – AI SEO Plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to and including 4.11.1 . The root cause is the software's failure to properly validate values before executing the do_shortcode function. This allows authenticated attackers with Subscriber-l...

EUVD-2026-102669

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...