EUVD-2026-82727

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-91707 Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-92622: Improper Neutralization of Input During Web Page Generation

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightboxclass' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-91707: Missing Authorization

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-84909: Improper Neutralization of Input During Web Page Generation

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-95276

Name of the Vulnerable Software and Affected Versions Divi versions 5.0 through 5.11.1 Description The software allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. If the 'Force Enable D4 Shortcod...

PT-2026-95301

Name of the Vulnerable Software and Affected Versions Strong Testimonials versions prior to 3.3.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web...

WordPress Divi theme 5.0-5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability

Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions 5.0-5.11.1...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-81316

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin (versions up to and including 1.8.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) via its Shortcode Attributes due to insufficient input sanitization and output escaping. According to the initial description, the ...

Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...

CVE-2026-86311: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

PT-2026-94138

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the shortcode attributes...

CVE-2026-19857

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

EUVD-2026-80218

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...