PT-2026-104552

Name of the Vulnerable Software and Affected Versions The Beaver Builder Page Builder – Drag and Drop Website Builder versions prior to 2.11.0.6 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the software fails to properly validate a value before...

PT-2026-104538

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4 Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

PT-2026-104498

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.3 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. This issue occurs when the...

CVE-2026-84740

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

EUVD-2026-88098

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744: Improper Control of Generation of Code

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-86612

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86604

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side...

EUVD-2026-85190

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86612

The Ninja Tables WordPress plugin, versions prior to 5.2.17 , contains a vulnerability where shortcode expansion is not restricted to administrator-authored table rows. In a non-default configuration, this allows unauthenticated users to execute arbitrary shortcodes on a public page by submitting...

PT-2026-96676

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.3 Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

CVE-2026-85116: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85117: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-19855: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2025-13146

The CVE-2025-13146 entry affects the WordPress plugin “Contact Form 7 – Dynamic Text Extension.” The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes by exploiting improper validation before do_shortcode, impacting all versions up to 5.0.6. A partial fix was introduc...

CVE-2026-3480

The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an adminpost action hook 'wp-blockade-shortcode-render' that maps to the rendershortcodepreview function. This function lacks any capability check...

CVE-2025-15463 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution

The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This make...