CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

EUVD-2026-83473

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-92229

The Forminator Forms plugin for WordPress (versions ≤ 1.57.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the improper validation of the current_url POST parameter (specifically during quiz AJAX actions such as forminator_submit_form_quizzes), which is refl...

CVE-2026-89274: Improper Control of Generation of Code

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-85658: Improper Control of Generation of Code

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

PT-2026-95746

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...

CVE-2026-92229: Improper Control of Generation of Code

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

WordPress Forminator Forms plugin <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter vulnerability

Unauthenticated Arbitrary Shortcode Execution via 'currenturl' Parameter vulnerability discovered by Kuba in WordPress Plugin Forminator versions = 1.57.2...

WordPress WP Recipe Maker plugin <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability

Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin WP Recipe Maker versions = 10.8.1...

CVE-2026-91707

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

EUVD-2026-82727

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707

The Divi theme for WordPress (versions up to and including 5.11.1 ) contains an arbitrary shortcode execution flaw caused by missing authorization on the content parameter via the Shortcode Module REST Endpoint . The value is not properly validated before being passed to do_shortcode, allowing un...

CVE-2026-91707: Missing Authorization

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

PT-2026-95276

Name of the Vulnerable Software and Affected Versions Divi versions 5.0 through 5.11.1 Description The software allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. If the 'Force Enable D4 Shortcod...

WordPress Divi theme 5.0-5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability

Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions 5.0-5.11.1...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...

Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...