CVE-2026-110516

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-110529.6Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process CVE-2026-1105238.1The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment ga CVE-2026-1105246.8The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storin CVE-2026-1105258.8The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in th CVE-2026-1105275.3The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration wh CVE-2026-1105307.2The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicat CVE-2026-1105328.6The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement CVE-2026-1105336.4The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_v CVE-2026-1105346.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and CVE-2026-1105358.8Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation CVE-2026-11053610.0A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CVE-2026-1105373.8The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user account