Live › vulnerability › CVE-2026-104001
Go to dashboardThe Slim SEO WordPress plugin up to and including 4.11.1 passes unvalidated author data to do_shortcode. A subscriber can save a shortcode payload in their Biographical Info field, and it runs on front-end author pages for any visitor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Slim SEO WordPress plugin at version 4.11.1 or earlier are exposed. The risk comes from any registration path that gives users the Subscriber role, since those users can write to their own profile bio. Sites without this plugin, or with it patched, can skip it.
No product ranges from the sources yet.
4.11.1.4.11.1; the sources do not name the exact fixed release, so check the plugin changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-104001")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.