CVE-2026-103908

MediumCVSS 5.4/10Last modified Nov 6, 2026

Description

The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	<= 1.1.18

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1039096.1The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Refl CVE-2026-1039116.5The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execut CVE-2026-1039124.7The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<at CVE-2026-1039137.5The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions CVE-2026-1039146.5The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including,CVE-2026-1039155.3The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio CVE-2026-1039168.4Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace CVE-2026-1039176.5The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all CVE-2026-1039186.5oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmart CVE-2026-1039217.4GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacy CVE-2026-1039229.3Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and i CVE-2026-1039232.1KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript