CVE-2026-81571

MediumCVSS 4.8/10Last modified Sep 3, 2026

Description

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-815727.8In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictabl CVE-2026-815738.6If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin rest CVE-2026-815748.2In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to in CVE-2026-815757.5If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length CVE-2026-815767.7If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically CVE-2026-815789.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u CVE-2026-815798.8In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows CVE-2026-81585.3The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exc CVE-2026-815818.8Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the p CVE-2026-815835.4The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite in CVE-2026-81597.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filen CVE-2026-81617.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request wit