CVE-2024-9772: The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including…

PriorityP356high7.3CVSS 3.1

AVNACLPRNUINSUCLILAL

EXPLOIT

EPSS

1.41%

69.3th percentile

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
uiux	uix_shortcodes	<= 1.9.9	—
uiuxlab	uix_shortcodes	<= 1.9.9	—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php↗

commandaction=uixscform_ajax_shortcodepreview&previewcode=[uix_sc_text text='...']↗

path/wp-content/plugins/uix-shortcodes/↗

path/wp-content/plugins/uix-shortcodes/readme.txt↗

→Detect unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter set to 'uixscform_ajax_shortcodepreview' — this is the vulnerable AJAX action that allows arbitrary shortcode execution without authentication. ↗
→Check for the presence of the plugin by probing /wp-content/plugins/uix-shortcodes/readme.txt and extracting the 'Stable tag' version; versions <= 1.9.7 (per nuclei template) / <= 1.9.9 (per NVD) are vulnerable. ↗
→The exploit requires no authentication (PR:N, UI:N per CVSS). Any unauthenticated POST to admin-ajax.php with this action should be treated as a potential exploitation attempt. ↗
→The vulnerable code path is in frontpage-init.php at line 9 of the plugin's trunk; review or monitor that file for tampering. ↗
→Content-Type of the exploit response is text/html with HTTP 200; correlate unauthenticated admin-ajax.php POSTs returning text/html containing shortcode output as a positive exploitation signal. ↗

·The Nuclei template targets versions <= 1.9.7, but NVD states all versions up to and including 1.9.9 are vulnerable. Detection rules should cover the broader range. ↗
·The Nuclei template uses a two-step flow: first verify plugin presence via readme.txt, then send the exploit POST. Detection logic should mirror this two-request pattern to reduce false positives. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.