CVE-2026-11778

MediumCVSS 5.4/10Last modified Jul 6, 2026

Description

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2026
Last modified: Jul 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-117795.3An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operati CVE-2026-11789.8A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.CVE-2026-117806.4The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'que CVE-2026-117812.7The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administ CVE-2026-117825.9The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points upd CVE-2026-117836.4The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to CVE-2026-117844.3The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site CVE-2026-117854.3A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address informat CVE-2026-117866.5A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing CVE-2026-117876.3A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, cau CVE-2026-117887.5A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure,CVE-2026-117896.5A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length fr