1359 matches found
CVE-2026-100159: Improper Control of Generation of Code
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
PT-2026-115533
Name of the Vulnerable Software and Affected Versions WP User Avatar / ProfilePress versions prior to 4.17.6 Description Authenticated users with Subscriber-level access and above can execute arbitrary shortcodes from any active plugin or theme. The issue occurs because the get user profile...
WordPress Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Slim SEO versions = 4.11.1...
WordPress User Registration & Membership plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution via displayname vulnerability discovered by hashiramasenju333 in WordPress Plugin User Registration versions = 5.2.8...
WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Theklis in WordPress Plugin Forminator versions = 1.58.1...
WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Forminator versions = 1.58.1...
WordPress Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin 6.4.1-6.4.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by YCInfosec in WordPress Plugin Popup box versions 6.4.1-6.4.2...
CVE-2026-86803
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
EUVD-2026-101839
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
CVE-2026-86803
The Ocean Extra plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in versions up to and including 2.6.0 . The flaw exists because the software allows the execution of an action that fails to properly validate a value before calling the do_shortcode function, spec...
CVE-2026-86803 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
CVE-2026-86803: Improper Control of Generation of Code
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
WordPress Ocean Extra plugin <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin Ocean Extra versions = 2.6.0...
CVE-2026-92097
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...
CVE-2026-92097 Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...
EUVD-2026-100770
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...
CVE-2026-92097
The Click to Chat for WhatsApp plugin for WordPress (versions up to and including 4.44 ) is vulnerable to Unauthenticated Arbitrary Shortcode Execution . The issue originates in the greetings_dialog() function, which constructs the {url} template placeholder using a sanitize_text_field()-filtered...
CVE-2026-92097: Improper Control of Generation of Code
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...
PT-2026-113600
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings dialog function building the url template placeholder from a sanitize text field-filtered $ SERVER'REQUEST URI' on archive pages a...
WordPress Click to Chat – HoliThemes plugin <= 4.44 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Click to Chat versions = 4.44...