ShapedPlugin — Vulnerabilities & Security Advisories 11

ShapedPlugin is a WordPress plugin designed to enhance website functionality through customizable shapes and interactive elements. Historically, it has been vulnerable to multiple security issues, including cross-site scripting (XSS), remote code execution (RCE), and privilege escalation vulnerabilities, with eight CVEs documented to date. These weaknesses often stem from insufficient input validation and improper access controls. The plugin's security posture has been compromised in incidents where attackers could execute arbitrary code or steal session cookies through unfiltered parameters. Despite its utility, ShapedPlugin's history of vulnerabilities has made it a target for exploitation, particularly in environments running outdated versions without proper hardening measures.