CVE-2026-4004

The Task Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'search' AJAX action in all versions up to, and including, 3.0.2. This is due to missing capability checks in the callback_search() function and insufficient input validation that allows shortcode syntax (square brackets) to pass through sanitize_text_field() and be concatenated into a do_shortcode() call. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes on the site by injecting shortcode syntax into parameters like 'task_id', 'point_id', 'categories_id', or 'term'.

• CWE-94

• https://plugins.trac.wordpress.org/browser/task-manager/tags/3.0.2/module/navigation/action/navigation.action.php#L29
• https://plugins.trac.wordpress.org/browser/task-manager/tags/3.0.2/module/navigation/action/navigation.action.php#L46
• https://plugins.trac.wordpress.org/browser/task-manager/tags/3.0.2/module/navigation/action/navigation.action.php#L75
• https://plugins.trac.wordpress.org/browser/task-manager/trunk/module/navigation/action/navigation.action.php#L29
• https://plugins.trac.wordpress.org/browser/task-manager/trunk/module/navigation/action/navigation.action.php#L46
• https://plugins.trac.wordpress.org/browser/task-manager/trunk/module/navigation/action/navigation.action.php#L75
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a902a6-c16f-4e0a-a13a-defb93754c92?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40034gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix bef…8.5
• CVE-2026-40035Unfurl through 2025.08 contains an improper input validation…9.3
• CVE-2026-40036Unfurl before 2026.04 contains an unbounded zlib decompressi…8.7
• CVE-2026-40037OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a r…7.1
• CVE-2026-40038Pachno 1.0.6 contains a stored cross-site scripting vulnerab…7.2
• CVE-2026-40039Pachno 1.0.6 contains an open redirection vulnerability that…7.1
• CVE-2026-40040Pachno 1.0.6 contains an unrestricted file upload vulnerabil…8.8
• CVE-2026-40041Pachno 1.0.6 contains a cross-site request forgery vulnerabi…5.3
• CVE-2026-40042Pachno 1.0.6 contains an XML external entity injection vulne…9.8
• CVE-2026-40043Pachno 1.0.6 contains an authentication bypass vulnerability…7.1
• CVE-2026-40044Pachno 1.0.6 contains a deserialization vulnerability that a…9.8
• CVE-2026-40045OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:/…5.9