CVE-2026-100157 WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519

The WP Ultimate Review plugin for WordPress (all versions up to and including 2.4.3 ) is vulnerable to arbitrary shortcode execution . The root cause is a failure to properly validate input before passing it to the do_shortcode function. Authenticated attackers with subscriber-level access or hig...

EUVD-2026-91959

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100152

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

EUVD-2026-91907

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

CVE-2026-100152

The All in One SEO WordPress plugin (versions up to and including 5.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the software's failure to properly validate a value before passing it to the do_shortcode function. An attacker can exploit this by triggeri...

CVE-2026-100152 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Samuele Santonicola in WordPress Plugin Beaver Builder versions = 2.11.0.5...

WordPress WP Ultimate Review plugin <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by walid213 in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution vulnerability

Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

CVE-2026-92924 Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-84740 The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

PT-2026-104415

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.2.1 Description Unauthenticated users can execute arbitrary shortcodes registered on the site because the plugin fails to correctly determine which shortcodes are present in content derived from user input...

PT-2026-104114

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - Ejecución arbitraria de shortcodes sin autenticación a través de wpajaxnoprivshortcodeApiAdd Descripción El complemento de WordPress WP Popup Builder – Popup Forms and Marketing Lead Generation es vulnerable a la...