{"id":"CVE-2026-110516","published":"2026-11-10T06:17:07.963","lastModified":"2026-11-10T16:28:46.510","description":"The All in One Addons For WPBakery Page Builder  (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/bce6e184-91b9-444b-bb23-c356cf0488cd/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}