CVE-2026-104397 WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2...

CVE-2026-104397

The Jeroen Peters Name Directory WordPress plugin (versions up to and including 1.34.2 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to Arbitrary Shortcode Execution . ...

WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by changsheng in WordPress Plugin Name Directory versions = 1.34.2...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

CVE-2026-89274

CVE-2026-89274 — WP Recipe Maker 임의 숏코드 실행 WP Recipe Maker 의 CVE-2026-89274에 대한 Python 3 PoC 스캐너/익스플로잇. | ---|--- 플러그인| wp-recipe-maker 영향받는 버전| ≤ 10.8.1 수정된 버전| 10.8.2+ CVSS| 9.1 치명적 인증| 인증 불필요 댓글 제출 CWE| CWE-94 요약 WPRMMetadata::sanitizemetadata는 메타데이터 필드에 대해 stripshortcodes 이전에 doshortcode를...

CVE-2026-92229

CVE-2026-92229 — Forminator 비인증 임의 숏코드 실행 ForminatorWPMU DEV의 CVE-2026-92229에 대한 Python 3 PoC 스캐너/익스플로잇. | ---|--- 플러그인| forminator 영향받는 버전| ≤ 1.57.2 수정된 버전| 1.57.3+ CVSS| 9.1 치명적 인증| 비인증 벡터| POST 파라미터 currenturl 퀴즈 AJAX CWE| CWE-94 코드 인젝션 공로| Kuba Wordfence 요약 취약한 버전에서는 사용자가 제공한 currenturl이 퀴즈 결...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution Description: The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.4. Th...

By-Poloss..-.CVE-2026-89274

CVE-2026-89274 PoC Poloss : @WPEF0 CVE-2026-89274 에 대한 Proof-of-Concept 익스플로잇 — WordPress 플러그인 WP Recipe Maker 버전 ≤ 10.8.1 의 Unauthenticated Arbitrary Shortcode Execution 취약점. ⚠️ 법적 및 윤리적 경고 이 스크립트는 로컬 환경localhost/lab에서의 보안 연구용으로만 제공되며, 본인 소유가 아니거나 서면 허가 없이 타인의 시스템에 사용해서는 안 됩니다. 작성자는 오용에 대해 책임지지...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

CVE-2024-13346

CVE-2024-13346 Avada Theme 7.11.14 - 인증되지 않은 임의 단축 코드 실행 CVE-2024-13346 익스플로잇 스크립트 설치 코드 git clone https://github.com/tausifzaman/CVE-2024-13346.git cd CVE-2024-13346 pip install -r requirements.txt python3 exploit.py Google Cloud Console Cloud Shell...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin All In One SEO Pack versions = 5.0.2...

WordPress WP Ultimate Review plugin <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Eunho Kim in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 2.11.0.5 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This vulnerability c...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-103519

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100157

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

EUVD-2026-91965

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100157 WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...