CVE-2026-104001

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104001
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104001.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104001
Published
2026-10-16T05:30:23Z
Modified
2026-10-17T02:47:36Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
Details

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104001.json"
}
References

Affected packages

Git / github.com/elightup/slim-seo

Affected ranges

Type
GIT
Repo
https://github.com/elightup/slim-seo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
346064b3223c83aec046e007585068efee18ac92
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "4.11.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.5.0
1.5.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.2
3.1.3
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.12.0
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.14.0
3.14.1
3.14.2
3.15.0
3.15.1
3.15.2
3.16.0
3.16.1
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.17.0
3.18.0
3.18.1
3.18.2
3.19.0
3.19.1
3.2.0
3.2.1
3.2.2
3.2.3
3.20.0
3.20.1
3.20.2
3.21.0
3.21.1
3.21.2
3.21.3
3.22.0
3.22.1
3.22.2
3.22.3
3.22.4
3.22.5
3.23.0
3.23.1
3.23.2
3.23.3
3.23.4
3.24.0
3.25.0
3.25.1
3.25.2
3.25.3
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.5.0
3.5.1
3.5.3
3.5.4
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.10.0
4.10.1
4.11.0
4.11.1
4.2.0
4.2.1
4.2.2
4.3.0
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.1
4.8.2
4.8.3
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104001.json"