WordPress security by component
Shortcodify
Plugin description
Shortcodify is a WordPress component with 1 published CVE record in this archive. The latest tracked vulnerability was published Jul 28, 2026; the highest CVE/CNA score is 5.
Plugin slug:
shortcodifyLatest vulnerability
CVE-2026-11598: Shortcodify contributors can store script through the section shortcode
Shortcodify through 1.4.3 allows a Contributor or higher to place attacker-controlled markup in the name attribute of the [section] shortcode. createAccordionSection() concatenates that value directly into an h3 element without sanitization or output escaping, so the payload executes in the site origin when the affected content is rendered. The official WordPress.org tags and trunk currently stop at 1.4.3 and retain the vulnerable code; no fixed release or patched function is disclosed.
| Safe version |
|
||
|---|---|---|---|
| Jul 28, 2026 |
CVE-2026-11598
Shortcodify contributors can store script through the section shortcode
Shortcodify through 1.4.3 allows a Contributor or higher to place attacker-controlled markup in the name attribute of the [section] shortcode. createAccordionSection() concatenates that value directly into an h3 element without sanitization or output escaping, so the payload executes in the site origin when the affected content is rendered. The official WordPress.org tags and trunk currently stop at 1.4.3 and retain the vulnerable code; no fixed release or patched function is disclosed.
|
See mitigation notes |
CVE5.0
NVDPending
|