CVE-2026-18021

MediumCVSS 6.5/10Last modified Sep 8, 2026

Description

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-180228.8Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to a CVE-2026-180235.7Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatio CVE-2026-180244.3Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a cr CVE-2026-180276.5The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Trav CVE-2026-180282.3The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a f CVE-2026-180296.3Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment s CVE-2026-18038.1A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This ma CVE-2026-180308.1The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted th CVE-2026-180319.8The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account asso CVE-2026-180327.5The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions,CVE-2026-180355.3The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated CVE-2026-180368.2In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are d