WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl quiz AJAX...

CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

EUVD-2026-114578

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2026-100155: kstover: The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress…

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Ninja Forms versions = 3.15.5...

WordPress Ad Inserter – Ad Manager & AdSense Ads plugin <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Ad Inserter versions = 2.8.19...

CVE-2026-118635

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a...

CVE-2026-102905: spacetime Ad Inserter – Ad Manager & AdSense Ads: The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in…

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2026-118635: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is…

The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Passakorn Yookindee in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-92798

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-92798 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

EUVD-2026-103233

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

PT-2026-116363

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description Insufficient input sanitization in the referrer url branch of the UR Smart Tags::process function allows unauthenticated attackers to execute arbitrary registered shortcodes. T...

CVE-2026-92798: Improper Control of Generation of Code

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...