CVE-2026-102291 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-102291

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to and including 6.3.1 . The root cause is the unfiltered substitution of a user's display_name into the page markup, which is subsequently processed ...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Sicherheitsforschungsmaterial zur Reproduktion und Validierung von CVE-2026-89274 : WP Recipe Maker Nur auf Systemen verwenden, die Sie besitzen oder für deren Test Sie ausdrücklich autorisiert sind. Der PoC...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 Codice PoC per la vulnerabilità di esecuzione arbitraria di shortcode non autenticata presente nel plugin WordPress WP Photo Album Plus. Dettagli Versioni interessate: = 8.8.08.007 Punteggio CVSS: 7.3 Alto Tipo di...

CVE-2026-104397

The Jeroen Peters Name Directory WordPress plugin (versions up to and including 1.34.2 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to Arbitrary Shortcode Execution . ...

WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by changsheng in WordPress Plugin Name Directory versions = 1.34.2...

CVE-2026-92229

CVE-2026-92229 — Esecuzione arbitraria di shortcode non autenticata in Forminator Scanner/exploit PoC in Python 3 per CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl...

Exploit for CVE-2026-92084

CVE-2026-92084 - Beaver Builder Arbitrary Shortcode Execution...

WordPress The Events Calendar plugin 6.12.0-6.17.5.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin The Events Calendar versions 6.12.0-6.17.5.0...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin All In One SEO Pack versions = 5.0.2...

WordPress WP Ultimate Review plugin <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Eunho Kim in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-92084 Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-100157

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.4.3 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. Specifically, the xs_reviw_summery parameter is ...

EUVD-2026-91959

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100152

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...