The User Registration & Membership plugin for WordPress versions up to and including 5.2.8 contains a code injection vulnerability. This arises from improper sanitization of the HTTP_REFERER header in the 'referrer_url' smart tag processing, allowing unauthenticated attackers to execute arbitrary registered shortcodes on restricted pages using the {{referrer_url}} tag. The vulnerability is classified as CWE-94 and has a high severity with a CVSS score of 8.1.
TuxGuitar versions prior to 2.1.0 contain a vulnerability where opening a crafted .tg file can lead to arbitrary code execution. This occurs because the application loads an attacker-supplied class from an untrusted archive without proper verification, executing it with the privileges of the TuxGuitar process. The issue is resolved in version 2.1.0.
CVE-2026-68571 is a high-severity code injection vulnerability in Apache Kylin affecting versions 4.0.0 through 5.0.4. The flaw arises from improper control of code generation via a special parameter in the JDBC URL. This vulnerability mainly impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is resolved in Apache Kylin version 5.0.5.
The WP User Avatar / ProfilePress plugin for WordPress (versions up to and including 4.17.5) contains a vulnerability that allows authenticated users with Subscriber-level access or higher to inject and execute arbitrary shortcodes via crafted comments. This occurs because the plugin processes comment excerpts with insufficient shortcode neutralization, enabling execution of any shortcode present in active plugins or themes when a visitor views the affected profile's Comments tab. The vulnerability can lead to limited confidentiality and integrity impacts by exposing capability-gated shortcodes and injecting raw HTML into publicly viewable pages.
The User Registration & Membership plugin for WordPress up to version 5.2.8 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before passing it to the do_shortcode function, leading to potential code injection.
The Slim SEO – AI SEO Plugin for WordPress up to version 4.11.1 contains a vulnerability allowing authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before running do_shortcode, enabling code injection via the author's Biographical Info field. The injected shortcode executes on unauthenticated front-end requests that display the author's description, such as those using the ?author= query parameter when auto_redirection is disabled.
Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to and including 1.58.1 is vulnerable to arbitrary shortcode execution. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes via a crafted GET request to the search results page or by submitting an anonymous comment on posts with comments enabled. No specific Forminator content or configuration is required to exploit this issue.
Forminator Forms plugin for WordPress versions up to 1.58.1 is vulnerable to arbitrary shortcode execution due to improper handling of user-controlled input in notification templates. This vulnerability allows unauthenticated attackers to execute arbitrary WordPress shortcodes by submitting crafted quiz data. The impact depends on other installed plugins and themes that register shortcodes, potentially leading to content injection or information disclosure.
The Broken Link Checker WordPress plugin up to version 2.4.14.1 contains a code injection vulnerability (CWE-94) that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode. Exploitation requires that a malicious shortcode payload be submitted in a comment and approved through normal moderation, after which the shortcode executes automatically via WP-Cron.
The Popup Box plugin for WordPress versions 6.4.1 to 6.4.2 contains a vulnerability that allows unauthenticated attackers to execute arbitrary registered shortcodes on the server. This occurs because the plugin processes client-controlled HTTP headers containing IP address information without properly escaping shortcode syntax characters before passing the content to the do_shortcode() function. Exploitation requires that an administrator has included the %%user_ip_address%% token in a popup's Custom Content body. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and has a CVSS 3.1 base score of 4.8 (medium severity). No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
The Ocean Extra plugin for WordPress contains a code injection vulnerability in all versions up to and including 2.6.0. This flaw allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation before calling do_shortcode. The vulnerability is identified as CWE-94 and has a CVSS 3.1 score of 6.5, indicating medium severity.
CVE-2026-55679 is an OS command injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to reach the pre-installation endpoint and inject commands via the 'usuario' parameter in the Linux reinstall flow. This leads to execution of arbitrary commands as the web-server user, persistence of attacker-controlled PHP configuration, and potential disruption or alteration of application data. The issue is fixed in version 3.8.6.
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
CVE-2026-85714 is a critical code injection vulnerability in Stirling-Tools Stirling-PDF versions prior to 2.13.2. An authenticated administrator using the default H2 database and security mode can upload a crafted SQL file that bypasses input validation, enabling execution of dangerous H2 functions. This leads to arbitrary file access and ultimately allows operating-system command execution as the JVM service account. The issue is fixed in version 2.13.2.
CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Access to the management interface should be restricted to trusted internal IPs to minimize risk. Multiple PAN-OS versions prior to specific fixed releases are affected.
CVE-2026-86787 is a high-severity vulnerability in the affiliate-toolkit WordPress plugin versions 3.8.7 up to but not including 3.9.1. It allows users with Contributor role or higher to supply a template body that is compiled and executed as PHP code by the plugin's templating engine, leading to arbitrary code execution on the server.
TeamPlus Messenger by TEAMPLUS TECHNOLOGY has a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to inject and execute arbitrary JavaScript. Exploitation requires tricking a user into interacting with crafted content and confirming a Windows security warning, leading to code execution with the current user's privileges. Versions from 16.8.0 through 17.0.6 are affected. The vulnerability has a high severity score of 8.6 CVSS 4.0.
TeamPlus Messenger versions 16.8.0 through 17.0.6 contain a code injection vulnerability (CWE-94) that allows unauthenticated remote attackers to execute arbitrary JavaScript by tricking users into opening a crafted link. Successful exploitation requires the user to confirm a Windows security warning, after which arbitrary code can run with the current user's privileges.
The Click to Chat for WhatsApp plugin for WordPress by HoliThemes contains a critical code injection vulnerability (CVE-2026-92097) in versions up to and including 4.44. This flaw allows unauthenticated attackers to execute arbitrary shortcodes by manipulating URL input that is improperly sanitized before being processed. The vulnerability arises because the plugin substitutes user-controlled URL data into greeting templates and passes them to the WordPress do_shortcode() function without removing shortcode delimiters, enabling execution of any shortcode registered by WordPress core, themes, or other plugins.