CVE-2024-9581: The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action

high Affects shortcodes-anywhere (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-10-10; advisory modified 2026-06-17.

The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action

Package: shortcodes-anywhere (WordPress plugin) WordPress
Affected versions: <=1.0.1
Fixed in: no fix recorded
Severity: high CVSS 7.3
Exploitation: not on CISA KEV · EPSS 0% (39.7th percentile)
Published: 2024-10-10
Source: nvd

References

CWE-94

NVD record shortcodes-anywhere (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same weakness: CWE-94
CVE-2024-56145 KEV critical Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled same weakness: CWE-94
CVE-2025-54068 KEV critical Livewire is vulnerable to remote command execution during component property update hydrat same weakness: CWE-94