CVE-2024-10909

The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. This was partially fixed in version 1.4.8.

• CWE-94

• https://plugins.trac.wordpress.org/browser/pojo-forms/tags/1.4.7/classes/class-pojo-forms-ajax.php#L16
• https://plugins.trac.wordpress.org/changeset/3201936/
• https://wordpress.org/plugins/pojo-forms/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/511ce6f6-aea3-4c37-8312-d6e5ff2fdf6f?source=cve

Published

Dec 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10903The Broken Link Checker WordPress plugin before 2.4.2 does n…4.7
• CVE-2024-10904There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-10905IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, Iden…9.8
• CVE-2024-10906In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app c…8.1
• CVE-2024-10907In lm-sys/fastchat Release v0.2.36, the server fails to hand…7.5
• CVE-2024-10908An open redirect vulnerability in lm-sys/fastchat Release v0…6.1
• CVE-2024-1091The ImageRecycle pdf & image compression plugin for WordPres…4.3
• CVE-2024-10910The The Grid Plus – Unlimited grid layout plugin for WordPre…7.3
• CVE-2024-10912A Denial of Service (DoS) vulnerability exists in the file u…7.5
• CVE-2024-10913The Clone plugin for WordPress is vulnerable to PHP Object I…8.8
• CVE-2024-10914A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-…9.8
• CVE-2024-10915A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-…9.8