CVE-2026-114702: WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector requires low-level privileges and user interaction. It is remotely reachable, but the available data does not identify the specific WordPress role or interaction required.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can result in stored cross-site scripting. The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Q: Which plugin versions are affected?

ND Shortcodes For Visual Composer versions through 7.8 are affected. No fixed version is provided in the available data.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.

Affected Software

1 affected component

Nicdark ND Shortcodes For Visual Composer<=7.8

Event History

Oct 22, 2026

CVE Published

via MITRE·08:58 AM

Data Sourced

via MITRE·08:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector requires low-level privileges and user interaction. It is remotely reachable, but the available data does not identify the specific WordPress role or interaction required.

What is the potential impact if exploitation succeeds?

Successful exploitation can result in stored cross-site scripting. The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Which plugin versions are affected?