CVE-2026-62098

The WordPress Boutique theme (versions

EUVD-2026-96287

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-102291

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to and including 6.3.1 . The root cause is the unfiltered substitution of a user's display_name into the page markup, which is subsequently processed ...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by dzaku in WordPress Plugin Kirki versions = 6.3.1...

CVE-2026-84220

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84220

The Kirki WordPress plugin prior to version 6.3.2 is vulnerable to unauthenticated arbitrary shortcode execution . The issue occurs because the plugin fails to prevent the execution of shortcodes contained within comments when they are rendered, and it displays these comments regardless of their ...

CVE-2026-84220 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Matériel de recherche de sécurité pour reproduire et valider CVE-2026-89274 : WP Recipe Maker À utiliser uniquement sur des systèmes que vous possédez ou que vous êtes explicitement autorisé à tester. Le PoC publie un...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - تنفيذ Shortcode تعسفي بدون مصادقة عبر wpajaxnoprivshortcodeApiAdd الوصف تعد إضافة WP Popup Builder – Popup Forms and Marketing Lead Generation لمنصة ووردبريس عرضة لتنفيذ shortcode تعسفي عبر إجراء AJAX...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus: تنفيذ Shortcode عشوائي CVE-2024-10958 كود PoC لثغرة تنفيذ shortcode عشوائي بدون مصادقة في إضافة WordPress WP Photo Album Plus. التفاصيل الإصدارات المتأثرة: = 8.8.08.007 درجة CVSS: 7.3 عالية نوع الثغرة: تنفيذ shortcode عشوائي وصف الثغرة تسمح إضافة WP Photo Album Plus...

WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Boutique versions = 2.3.3...

CVE-2026-104397

The Jeroen Peters Name Directory WordPress plugin (versions up to and including 1.34.2 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , potentially leading to Arbitrary Shortcode Execution . ...

CVE-2026-104397 WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2...

CVE-2026-104397 WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2...

WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

Arbitrary Shortcode Execution vulnerability discovered by changsheng in WordPress Plugin Name Directory versions = 1.34.2...

CVE-2026-89274

CVE-2026-89274 — Exécution arbitraire de shortcodes dans WP Recipe Maker Scanner/exploit PoC en Python 3 pour CVE-2026-89274 dans WP Recipe Maker. | ---|--- Plugin| wp-recipe-maker Affecté| ≤ 10.8.1 Corrigé dans| 10.8.2+ CVSS| 9.1 Critique Auth| Non authentifié soumission de commentaire CWE| CWE-...

CVE-2026-92229

CVE-2026-92229 — Exécution arbitraire de shortcodes non authentifiée dans Forminator Scanner/exploit PoC en Python 3 pour CVE-2026-92229 dans Forminator WPMU DEV. | ---|--- Plugin| forminator Affecté| ≤ 1.57.2 Corrigé dans| 1.57.3+ CVSS| 9.1 Critique Auth| Non authentifié Vecteur| Paramètre POST...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - تنفيذ شورتكود عشوائي غير موثّق الوصف: مكوّن الـ الـ MDTF – Meta Data and Taxonomies Filter الإضافي لووردبريس معرّض لتنفيذ شورتكود عشوائي في جميع الإصدارات حتى 1.3.3.4. يرجع ذلك إلى أن البرنامج يسمح للمستخدمين بتنفيذ إجراء ل...