CVE-2024-8481 HIGH

CVE-2024-8481: Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution

Vendor Minimus
Product Special Text Boxes
Weakness CWE-94 · Code injection
Published September 25, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Key dates

02Disclosure timeline

September 25, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-0761 Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability CVE-2025-67489 @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server CVE-2021-38117 Possible Remote Code Execution Vulnerability OpenText iManager CVE-2025-48169 WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability CVE-2021-21345 XStream is vulnerable to a Remote Command Execution attack