CVE-2026-110516 All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode Attribute

The All in One Addons For WPBakery Page Builder formerly Visual Composer WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute...