WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2026-92084-beaver-builder-shortcode-poc

CVE-2026-92084 - Beaver Builder Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-92084 : Beaver Builder Lite false; the bracket-encoding machinery itself shipped earlier and is unchanged CVSS 3.1: 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A...

CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl quiz AJAX...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2026-119302: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its…

The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered...

VulnCheck KEV: CVE-2025-6744

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the...

CVE-2026-102564

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

EUVD-2026-119135

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-102564

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin, in versions up to and including 1.3.0 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to properly validate values before passing them to the do_shortcode function. An at...

CVE-2026-102564 Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-103917

The The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running...

WordPress Dynific Addons for Elementor (formerly Anywhere Elementor) plugin <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin AnyWhere Elementor versions = 1.3.0...

WordPress Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

EUVD-2026-117972

The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

EUVD-2026-114578

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-100155: kstover: The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress…

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Ninja Forms versions = 3.15.5...