PULSE
ESPT
FEED
ransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerceransomblack x reclama a Forus Deporte y Ocio S.L · ES · Hospitalityransomblack x reclama a DomusVi · ES · Healthcareransomvortex reclama a CRESA · US · Professional Servicesransomvortex reclama a ALEXION · US · Healthcareransomvortex reclama a PYRAMID HEALTHCARE · US · Healthcareransomn0n reclama a Landmark Group · AE · Retail & E-Commerceransomn0n reclama a Vertex Pharmaceuticals Incorporated · US · Healthcareransomiah6477 reclama a fhiworks · Healthcareransomaoqin reclama a Irwin Automotive Group · US · Retail & E-Commerceransomsilentransomgroup reclama a Wilentz, Goldman & Spitzer · Professional Servicesransomsilentransomgroup reclama a B... W...ransompixelleaks reclama a Published · Technologyransomglobal secret group reclama a Ornico · ZA · Professional Servicesransomglobal secret group reclama a Heartland Honda · US · Retail & E-Commerce
← All CVEs
CVE WatchNov 10, 2026

CVE-2026-110516

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attri

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.

Official references
Related CVEs

No related CVEs by CWE or product.