ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

CVE-2026-109973

The Image Hover Effects Ultimate Visual Composer Flipbox - Awesomes Flip Boxes Image Overlay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-a...

CVE-2026-109973 Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

The Image Hover Effects Ultimate Visual Composer Flipbox - Awesomes Flip Boxes Image Overlay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-a...

CVE-2026-109973

The Flipbox (Awesomes Flip Boxes Image Overlay) plugin for WordPress, versions up to and including 3.1.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'flip-box-image-upload-url-01-alt' parameter because the plugin uses sanitize_text_field() in Inc/Style22::registe...

EUVD-2026-119215

The Image Hover Effects Ultimate Visual Composer Flipbox - Awesomes Flip Boxes Image Overlay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-a...

EUVD-2026-119135

The The Dynific Addons for Elementor formerly Anywhere Elementor plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-102564

The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin, in versions up to and including 1.3.0 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is a failure to properly validate values before passing them to the do_shortcode function. An at...

CVE-2026-103917

The The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 11.2.7 . The root cause is a failure to properly validate a value before executing the do_shortcode function. Because the submission nonce i...

EUVD-2026-118958

The The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2026-117525

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

CVE-2026-117525 FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

EUVD-2026-118932

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

CVE-2026-117525

The FV Flowplayer Video Player WordPress plugin versions prior to 7.5.57.7212 is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the failure to escape shortcode attribute values embedded in comments before they are rendered into the media player markup. If the non-def...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution Description: The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.4. Th...

CVE-2026-120082 GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.200 due to insufficient input sanitization and output escaping. This makes ...