Description The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. References https://wordpress.org/plugins/shortcode-factory/#developers