WordPress Custom Query Shortcode Vulnerabilities