Read the docs

nicdark

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

nicdark records in CISA KEV

No nicdark vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cost Calculator 3 records MEDIUM Nd Shortcodes 3 records HIGH Hotel Booking 1 record LOW Nd-travel 1 record LOW Restaurant Reservations 1 record LOW

Records

3 records in Nd Shortcodes · all components

TI-2023-01202 CVE-2023-1273 · GHSA-jgrp-j9c7-qv87

ND Shortcodes < 7.0 - Subscriber+ LFI

Priority HIGH 73

The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform L…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01683 Published 2023-07-04 Fixed in 7.0
TI-2022-04224 CVE-2022-4623 · GHSA-fwvm-hvrc-gmv3

ND Shortcodes < 7.0 - Contributor+ Stored XSS via Shortcodes

Priority MEDIUM 58

The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00444 Published 2023-07-04 Fixed in 7.0
TI-2024-04844 CVE-2024-5220

ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 28

The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-05-25 No fix listed CWE-79
Open these records in search →