WordPress Forminator Forms plugin <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter vulnerability

Unauthenticated Arbitrary Shortcode Execution via 'currenturl' Parameter vulnerability discovered by Kuba in WordPress Plugin Forminator versions = 1.57.2...

WordPress WP Recipe Maker plugin <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability

Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin WP Recipe Maker versions = 10.8.1...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-91707

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

EUVD-2026-82727

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707

The Divi theme for WordPress (versions up to and including 5.11.1 ) contains an arbitrary shortcode execution flaw caused by missing authorization on the content parameter via the Shortcode Module REST Endpoint . The value is not properly validated before being passed to do_shortcode, allowing un...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-92622: Improper Neutralization of Input During Web Page Generation

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightboxclass' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-84909: Improper Neutralization of Input During Web Page Generation

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-91707: Missing Authorization

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WordPress Divi theme 5.0-5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability

Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions 5.0-5.11.1...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-81316

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin (versions up to and including 1.8.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) via its Shortcode Attributes due to insufficient input sanitization and output escaping. According to the initial description, the ...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...