CVE-2026-80437

MediumCVSS 4.8/10Last modified Sep 8, 2026

Description

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-804385.9The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress pCVE-2026-804394.8The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from beingCVE-2026-80448.6CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote codeCVE-2026-804404.8The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes thoCVE-2026-804419.8IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery fuCVE-2026-804428.8IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionalitCVE-2026-804437.4Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue CVE-2026-804445.4URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This iCVE-2026-80456.5CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fiCVE-2026-80468.1The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can explCVE-2026-8046210.0A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to CVE-2026-80463Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attacke