Jakub Herman

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

🚨 CVE-2026-80439 The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output. 🎖@cveNotify

🚨 CVE-2026-19859 The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed. 🎖@cveNotify

🚨 CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments. 🎖@cveNotify

🚨 CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. 🎖@cveNotify

🚨 CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone. 🎖@cveNotify

🚨 CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. 🎖@cveNotify

🚨 CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Hummingbird Performance versions prior to 3.21.2 **Description** In multisite network configurations, a network-wide setting is not properly restricted to network administrators. This allows an administrator of a single site within the network to execute arbitrary code across the entire network. **Recommendations** Update Hummingbird Performance to version 3.21.2 or later.

**Name of the Vulnerable Software and Affected Versions** Comments WordPress plugin versions prior to 7.6.66 **Description** An issue exists where the software fails to validate a value used to construct a database query. This allows unauthenticated users to perform SQL injection, enabling them to read comments they are not authorized to access, such as those awaiting moderation, marked as spam, trashed, or associated with private and draft posts. The injected text is processed as grammar rather than data, limiting the impact to the disclosure of comment content rather than the entire database. **Recommendations** Update Comments WordPress plugin to version 7.6.66 or later.

**Name of the Vulnerable Software and Affected Versions** My Login WordPress plugin versions prior to 7.2.0 **Description** On multisite installations, the plugin fails to enforce the network registration settings during site signup processing. This allows unauthenticated users on certain networks and users with subscriber accounts to create new sites and automatically obtain administrator privileges over them. **Recommendations** Update the My Login WordPress plugin to version 7.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** JetBackup WordPress plugin versions prior to 3.1.23.5 **Description** An issue exists where the plugin fails to verify the role or capabilities of an account preserved during a restore or migration process before granting it administrator privileges. This allows a user with subscriber-level permissions to escalate their privileges to administrator status after the site owner performs a site restore or migration. **Recommendations** Update JetBackup WordPress plugin to version 3.1.23.5 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields: Extended WordPress plugin versions prior to 0.9.2.7 **Description** Insufficient restriction of roles submitted through front-end user forms allows unauthenticated visitors to register accounts with elevated capabilities. Due to an incomplete safeguard against privileged roles, an attacker can escalate their privileges to the administrator level. **Recommendations** Update the plugin to version 0.9.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** MW WP Form versions prior to 5.1.5 **Description** An issue exists where user-submitted values containing shortcodes are not properly sanitized before being merged into a message that is subsequently processed for shortcodes. This allows unauthenticated users to execute any shortcode registered on the site. This occurs when the site is configured to echo a submitted value back to the visitor after submission. **Recommendations** Update MW WP Form to version 5.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Ultimate Member WordPress plugin versions prior to 2.13.0 **Description** An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's specific allow-list, the system validates the value against the site's registered role names. This allows unauthenticated users registering through the plugin's form to assign themselves arbitrary capabilities, potentially gaining administrator-equivalent access. **Recommendations** Update Ultimate Member WordPress plugin to version 2.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** Breeze Cache WordPress plugin versions prior to 2.5.13 **Description** An issue exists where the plugin fails to sanitize a value received from a request used to construct file paths for cached files. This allows unauthenticated attackers to perform a path traversal attack to create files at arbitrary locations on the server, bypassing the intended cache directory restrictions. **Recommendations** Update Breeze Cache WordPress plugin to version 2.5.13 or later.

**Name of the Vulnerable Software and Affected Versions** Smush WordPress plugin versions prior to 4.3.2 **Description** Insufficient restriction of a network-wide setting allows an administrator of a single site within a multisite network to execute arbitrary code across the entire network. **Recommendations** Update Smush WordPress plugin to version 4.3.2 or later.