CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86604

The GTranslate WordPress plugin prior to version 5.0.1 is vulnerable to a flaw where shortcodes are not removed from outgoing email content before expansion. In a non-default configuration, this allows unauthenticated users to have arbitrary shortcodes registered on the site executed on the serve...

CVE-2026-86604 GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side...

CVE-2026-86601

The WP Recipe Maker WordPress plugin, in versions prior to 10.8.2 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcodes from comment content before expanding them during the generation of a page's structured metadata . This flaw allo...

PT-2026-97271

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

WordPress GiveWP plugin < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.9...

WordPress Meow Gallery plugin < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by JunHee CHO in WordPress Plugin Meow Gallery versions 5.5.5...

CVE-2026-92235

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

WordPress WP Ultimate Review plugin <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by jtb75 in WordPress Plugin Wp Ultimate Review versions = 2.4.2...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin ProfilePress versions = 4.17.2...

EUVD-2026-84305

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-92235 WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-92235 WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-92235

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2 . The root cause is that the xs_submit_review_data[xs_reviw_summery] parameter is not properly validated before being passed to do_shortcode , allowing authentica...

CVE-2026-92235: Improper Control of Generation of Code

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-85113

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113

GiveWP WordPress plugin versions before 4.16.9 fail to remove shortcode delimiters from donor-supplied values (such as donor names) before rendering them on public pages. The shortcode-stripping logic the plugin applies can be defeated by nesting , allowing unauthenticated users to execute arbitr...

CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...