CVE-2026-92422

The Meow Gallery WordPress plugin (versions before 5.5.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The flaw exists because the plugin fails to properly sanitize user-supplied values before concatenating them into a shortcode string, which is then processed by the WordPres...

CVE-2026-92422: Insufficient Verification of Data Authenticity

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered...

Exploit for CVE-2026-89274

CVE-2026-89274 — WP Recipe Maker Arbitrary Shortcode Execution...

Exploit for CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcod...

CVE-2026-85658

ProfilePress (Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content) for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 4.17.2 . The root cause is improper validation of a value before passing it to do_...

CVE-2026-85658 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

EUVD-2026-83554

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

CVE-2026-85658 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-89274

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

EUVD-2026-83476

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274

WP Recipe Maker for WordPress (all versions ≤ 10.8.1) is vulnerable to unauthenticated arbitrary shortcode execution via recipe comment content. The root cause lies in WPRM_Metadata::sanitize_metadata(), which recursively calls do_shortcode() on every scalar metadata field — including reviewBody,...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

EUVD-2026-83473

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229

The Forminator Forms plugin for WordPress (versions ≤ 1.57.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the improper validation of the current_url POST parameter (specifically during quiz AJAX actions such as forminator_submit_form_quizzes), which is refl...

CVE-2026-89274: Improper Control of Generation of Code

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...