CVE-2024-11976

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-119777.3The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers CVE-2024-119787.5DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to rea CVE-2024-119799.8DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated CVE-2024-11989.8A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file applicati CVE-2024-119808.6Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to dir CVE-2024-119817.5Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive con CVE-2024-119827.2Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator pri CVE-2024-119837.2Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator priv CVE-2024-119848.8A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.1 CVE-2024-119854.4An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Impr CVE-2024-119869.6Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administ CVE-2024-11997.5A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerabilit