EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820

WPComplete is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) via the 'empty' Shortcode Attribute in all versions up to and including 2.9.9.0 . The root cause is insufficient input sanitization and output escaping . Attackers with contributor-level access or higher can inject a...

CVE-2026-77820: Improper Neutralization of Input During Web Page Generation

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-89274: Improper Control of Generation of Code

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

PT-2026-95746

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the...

PT-2026-95793

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.3 Description The ProfilePress plugin for WordPress allows authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes. This occurs because the software fails to properly...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

PT-2026-95778

Name of the Vulnerable Software and Affected Versions Real3D Flipbook Lite versions prior to 5.1.2 Description Stored Cross-Site Scripting is possible due to insufficient input sanitization and output escaping in the on shortcode and print global options functions. The issue occurs when shortcode...

PT-2026-95747

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin by PDFCrowd versions prior to 4.6.2 Description The plugin is susceptible to Arbitrary Function Invocation. The eval shortcode function copies shortcode attributes into a custom options array without sanitization or capabili...

CVE-2026-85658: Improper Control of Generation of Code

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

PT-2026-95733

Name of the Vulnerable Software and Affected Versions WPComplete versions prior to 2.9.9.1 Description The pro version of the WPComplete plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the empt...

CVE-2026-92229: Improper Control of Generation of Code

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...

WordPress Forminator Forms plugin <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter vulnerability

Unauthenticated Arbitrary Shortcode Execution via 'currenturl' Parameter vulnerability discovered by Kuba in WordPress Plugin Forminator versions = 1.57.2...

WordPress WP Recipe Maker plugin <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability

Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin WP Recipe Maker versions = 10.8.1...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-91707

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

EUVD-2026-82727

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...