Arbitrary shortcode execution in Dynific Addons for Elementor
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
Dynific Addons for Elementor (formerly Anywhere Elementor) for WordPress is affected up to and including 1.3.0. The plugin does not validate a value before running do_shortcode, a code generation flaw (CWE-94). An unauthenticated attacker can run arbitrary shortcodes when a public post rendered through an AE template includes the AE Post Comments widget and the attacker's comment is visible on that page. A previously approved comment or relaxed comment moderation makes the comment visible.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on that page — a barrier removed once the attacker has a previously approved comment or when comment moderation is relaxed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Dynific Addons for Elementor (formerly Anywhere Elementor).
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-102564
- 2026-11-07 Alias added: GHSA-pqvc-9q7p-f55r
- 2026-11-08 CISA SSVC decision points changed
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/15ee70d7-1e55-46a3-9b4c-5b04fa7fea04?source=cve
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/frontend.php#L205
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/shortcode.php#L27
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/trunk/includes/modules/post-comments/widgets/ae-post-comments.php#L191
- https://plugins.trac.wordpress.org/browser/anywhere-elementor/tags/1.3.1/includes/modules/post-comments/widgets/ae-post-comments.php
More wpvibes vulnerabilities
- TI-2024-01266 Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion CVSS 3.1HIGH 8.8
- TI-2023-05195 WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints CVSS 3.1HIGH 7.6
- TI-2022-03455 Form Vibes < 1.4.5 - Admin+ SQLi CVSS 3.1HIGH 7.2
- TI-2023-00420 AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure CVSS 3.1MEDIUM 5.3
- TI-2024-01328 Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet CVSS 3.1MEDIUM 6.4
- TI-2023-05215 WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-102564 · CVE Program
- CVE-2026-102564 · NVD
- GHSA-pqvc-9q7p-f55r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences