CVE-2026-102564

Name of the Vulnerable Software and Affected Versions Dynific Addons for Elementor versions prior to 1.3.1

Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before executing the do shortcode() function. This issue occurs when a public post is rendered using an AE template that includes the AE Post Comments widget. Exploitation is possible if the attacker's comment is visible on the page, which can happen if comment moderation is relaxed or if the attacker has a previously approved comment.

Recommendations Update to a version newer than 1.3.0. Restrict the use of the AE Post Comments widget until the update is applied.