CVE-2024-9578 Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution

The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to doshortcode being hooked through the commenttext filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the...

CVE-2024-9846

The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...

PT-2024-39884 · WordPress · Enable Shortcodes Inside Widgets

Name of the Vulnerable Software and Affected Versions: The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress version 1.0.0 and earlier Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a val...

PT-2024-39832 · WordPress · Uix Shortcodes

Name of the Vulnerable Software and Affected Versions: The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress versions up to, and including, 1.9.9 Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not...

CVE-2024-7381

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajaxshortcodecache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary...

PT-2024-28820 · WordPress · Wp Photo Album Plus

Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions up to, and including, 8.7.02.003 Description: The issue allows unauthenticated users to execute an action that does not properly validate a value before running do shortcode, making it possible for unauthenticated...

CVE-2024-3957

The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what...

PT-2024-27485 · Woocommerce · Fox – Currency Switcher Professional

Name of the Vulnerable Software and Affected Versions: The FOX – Currency Switcher Professional for WooCommerce plugin versions up to, and including, 1.4.1.8 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability of this issue depe...

CVE-2023-25790 WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection

Improper Authentication, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtemos WoodMart allows Cross-Site Scripting XSS.This issue affects WoodMart: from n/a through 7.0.4...

Cross site request forgery (csrf)

The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cpshortcoderefresh function. This makes it possible for unauthenticated attackers to execute arbitra...

Colibri Page Builder < 1.0.260 - Arbitrary Shortcode Call via CSRF

Description The plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the cpshortcoderefresh function, allowing unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator int...

WordPress OptinMonster Plugin <= 1.1.4.5 - Execution of Arbitrary Shortcodes

Because of this vulnerability, unauthenticated users can execute arbitrary WordPress shortcodes via a simple HTTP GET request. Solution Update the plugin...