CVE-2026-102564: Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

Q: Which sites are exposed to unauthenticated exploitation?

Exposure requires a public post that is rendered through an AE template containing the AE Post Comments widget. The attacker's comment must also be visible on that page.

Q: What does an attacker need before malicious shortcodes can execute?

The attacker must be able to submit a comment whose content becomes visible in the affected comments output. A previously approved comment removes the visibility barrier, and relaxed comment moderation can also allow exploitation.

Q: Are all installations using the plugin equally affected?

No. Although the issue affects versions through 1.3.0, exploitation depends on the specific template and comment configuration: the AE Post Comments widget must be used on a publicly rendered post and attacker-controlled comments must be displayed.

Published Nov 7, 2026

Updated

The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on that page — a barrier removed once the attacker has a previously approved comment or when comment moderation is relaxed.

Event History

Nov 7, 2026

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

Exposure requires a public post that is rendered through an AE template containing the AE Post Comments widget. The attacker's comment must also be visible on that page.

What does an attacker need before malicious shortcodes can execute?

The attacker must be able to submit a comment whose content becomes visible in the affected comments output. A previously approved comment removes the visibility barrier, and relaxed comment moderation can also allow exploitation.

Are all installations using the plugin equally affected?

No. Although the issue affects versions through 1.3.0, exploitation depends on the specific template and comment configuration: the AE Post Comments widget must be used on a publicly rendered post and attacker-controlled comments must be displayed.

CVE-2026-102564: Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

Event History

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need before malicious shortcodes can execute?

Are all installations using the plugin equally affected?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need before malicious shortcodes can execute?

Are all installations using the plugin equally affected?