The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x WordPress plugin is vulnerable to code injection via arbitrary shortcode execution in all versions up to and including 2.2.14. The flaw arises from insufficient validation of user-supplied input before invoking the do_shortcode function, enabling unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment. This vulnerability is categorized under CWE-94 (Improper Control of Generation of Code). No official patch or remediation level has been confirmed as of the published date.

An attacker without authentication can execute arbitrary shortcodes, which may lead to limited confidentiality and integrity impacts within the WordPress site context. The CVSS score of 5.4 reflects a medium severity, indicating that while the vulnerability allows code injection, the overall impact on availability is none and privileges required are low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable plugin functionality and monitor for updates from the vendor villatheme. Avoid exposing the affected plugin to untrusted users to reduce risk.