CVE-2026-110516
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 10, 2026
Vendor
unknown
Description
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.