CVE-2026-2363

The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderby' attribute of the wpmemusermembershipposts shortcode in all versions up to, and including, 3.5.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient...

Default credentials

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activati...

PT-2023-16613 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WordPress Shortcodes Plugin — Shortcodes Ultimate versions prior to 5.12.8 Description: The issue allows any authenticated users, such as subscribers, to retrieve arbitrary user meta, excluding the user pass, via the user shortcode. This...

Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure

The plugin does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta except the userpass, such as the user email and activation key by default. PoC Run one of the below commands in the developer...