CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744 WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-84744

The WPForms Lite WordPress plugin (versions 1.5.0.1 to 2.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcode delimiters from submitted field values before repopulating them into the rendered form. This flaw allows an unauthentic...

PT-2026-99773

Name of the Vulnerable Software and Affected Versions WPForms Lite versions 1.5.0.1 through 2.0.2 Description The plugin fails to remove shortcode delimiters from submitted field values before they are written back into the rendered form. This allows unauthenticated users to execute arbitrary...

WordPress Ninja Tables plugin < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Ninja Tables versions 5.2.17...

WordPress GTranslate plugin < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin GTranslate versions 5.0.1...

Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86604 GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side...

CVE-2026-86604 GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side...

CVE-2026-86601

The WP Recipe Maker WordPress plugin, in versions prior to 10.8.2 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcodes from comment content before expanding them during the generation of a page's structured metadata . This flaw allo...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86604

The GTranslate WordPress plugin prior to version 5.0.1 is vulnerable to a flaw where shortcodes are not removed from outgoing email content before expansion. In a non-default configuration, this allows unauthenticated users to have arbitrary shortcodes registered on the site executed on the serve...

PT-2026-97271

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

WordPress GiveWP plugin < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.9...

WordPress Meow Gallery plugin < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by JunHee CHO in WordPress Plugin Meow Gallery versions 5.5.5...

CVE-2026-92235

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

WordPress WP Ultimate Review plugin <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by jtb75 in WordPress Plugin Wp Ultimate Review versions = 2.4.2...