# AnyWhere Elementor <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comments

- **ID:** WPSEC-2026-2196
- **Plugin:** Dynific Addons for Elementor (formerly Anywhere Elementor) (`anywhere-elementor`), https://wordpress.org/plugins/anywhere-elementor/
- **Affected versions:** all versions before 1.3.1
- **Fixed in:** 1.3.1 (Update to 1.3.1 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/anywhere-elementor
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2196/

## Description

The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution via comments in all versions up to, and including, 1.3.0. This is due to render_insert_elementor() running do_shortcode() over the entire rendered template output, which includes comment text printed by the Post Comments widget. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by posting a comment on a post displayed with a template, for example to render the content of other posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2196/
- https://plugins.svn.wordpress.org/anywhere-elementor/tags/1.3.1/
- https://wordpress.org/plugins/anywhere-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2196/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.