Uix Shortcodes Vulnerable to Arbitrary Shortcode Execution

CVE-2024-9772

Summary

The Uix Shortcodes plugin for WordPress is susceptible to a serious security issue that permits arbitrary shortcode execution across all versions up to and including 1.9.9. This vulnerability arises from the plugin's failure to correctly validate user input before executing the do_shortcode function, enabling unauthenticated attackers to inject and execute malicious shortcodes. As a result, this flaw presents significant risks, including potential unauthorized access or manipulation of site content, making it imperative for users to update to the latest version or implement security measures.

References