The Grid Plus – Unlimited grid layout plugin for WordPress suffers from a code injection vulnerability (CWE-94) because it does not properly validate user input before executing shortcodes via the grid_plus_load_by_category AJAX action. This flaw allows unauthenticated attackers to run arbitrary shortcodes, potentially leading to unauthorized code execution. The vulnerability affects all versions up to and including 1.3.5. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker can exploit this vulnerability to execute arbitrary shortcodes without authentication, which may lead to unauthorized code execution within the WordPress environment. This can compromise the confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable AJAX action if possible, or removing the plugin if it is not essential. Monitor vendor channels for updates or patches.