CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl quiz AJAX...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

CVE-2026-92966

CVE-2026-92966 — LatePoint ≤ 5.7.0 unauthenticated stored shortcode execution Field| Value ---|--- CVE| CVE-2026-92966 Product| LatePoint — Appointment Booking Affected| ≤ 5.7.0 Fixed| 5.7.1 CWE| CWE-94 — Code injection shortcode execution CVSS 3.1| 9.1 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...

CVE-2026-89274

CVE-2026-89274 — WP Recipe Maker Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-89274 in WP Recipe Maker. | ---|--- Plugin| wp-recipe-maker Affected| ≤ 10.8.1 Fixed in| 10.8.2+ CVSS| 9.1 Critical Auth| Unauthenticated comment submit CWE| CWE-94 Summary...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

By-Poloss..-.CVE-2026-89274

CVE-2026-89274 PoC Poloss : @WPEF0 Proof-of-Concept exploit untuk CVE-2026-89274 — kerentanan Unauthenticated Arbitrary Shortcode Execution pada plugin WordPress WP Recipe Maker versi ≤ 10.8.1. ⚠️ LEGAL & ETHICAL WARNING This script is provided only for security research in a local environment...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wpajaxnoprivshortcodeApiAdd Description The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary...

CVE-2024-13346

CVE-2024-13346 Avada Theme 7.11.14 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-13346 exploit script Installation Code git clone https://github.com/tausifzaman/CVE-2024-13346.git cd CVE-2024-13346 pip install -r requirements.txt python3 exploit.py Google Cloud Console Cloud Shell...

CVE-2026-92084-beaver-builder-shortcode-poc

CVE-2026-92084 - Beaver Builder Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-92084 : Beaver Builder Lite false; the bracket-encoding machinery itself shipped earlier and is unchanged CVSS 3.1: 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A...

WordPress NotificationX plugin < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution vulnerability

Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution vulnerability discovered by vuxvinh in WordPress Plugin NotificationX versions 3.3.7...

CVE-2026-119302

The NotificationX WordPress plugin (versions prior to 3.3.7 ) is vulnerable to unauthenticated non-public content disclosure and arbitrary shortcode execution . The root cause is a lack of capability, authentication, or nonce checks on the plugin's notification preview path . This allows unauthen...

EUVD-2026-123276

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

CVE-2026-119302 NotificationX < 3.3.7 - Unauthenticated Non-Public Content Disclosure and Arbitrary Shortcode Execution via Notification Preview

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2026-119302: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its…

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

VulnCheck KEV: CVE-2025-6744

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the...

CVE-2026-102564

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

EUVD-2026-119135

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-102564

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin, in versions up to and including 1.3.0 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to properly validate values before passing them to the do_shortcode function. An at...