What’s Vulnerable › Vulnerabilities

CVE-2024-9578: Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-13 · updated 2026-06-17
• Weakness: CWE-862

Description

The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Affected products

• egolacrima Hide Links: through 1.4.2

References

• https://plugins.trac.wordpress.org/browser/hide-links/trunk/class.hidelinks.php#L21
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4198bbb2-3aff-492e-a781-b0c9477baf6c?source=cve

Get alerted when CVE-2024-9578 or the next vulnerability affects your stack