Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: nicdark Component: Nd Shortcodes Clear all filters
TI-2024-04844 CVE-2024-5220

ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 28

The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-05-25 No fix listed CWE-79
TI-2023-01202 CVE-2023-1273 · GHSA-jgrp-j9c7-qv87

ND Shortcodes < 7.0 - Subscriber+ LFI

Priority HIGH 73

The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform L…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01683 Published 2023-07-04 Fixed in 7.0
TI-2022-04224 CVE-2022-4623 · GHSA-fwvm-hvrc-gmv3

ND Shortcodes < 7.0 - Contributor+ Stored XSS via Shortcodes

Priority MEDIUM 58

The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00444 Published 2023-07-04 Fixed in 7.0