{"id":"CVE-2026-114702","kind":"vulnerability","aliases":["CVE-2026-114702"],"related":[],"title":"ND Shortcodes For Visual Composer: stored XSS through web page generation","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.","summary":"ND Shortcodes For Visual Composer, a WordPress plugin by nicdark, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can get script stored in page content can run it in the browser of anyone who views that page.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nd-shortcodes","package","visual-composer","wordpress"],"not_affected_if":["plugin-not-installed","trusted-editors-only"],"how_to_check":"- Check the installed plugin version of `nd-shortcodes` in the WordPress admin under Plugins, or with `wp plugin get nd-shortcodes --field=version`\n- Compare the result against the affected range, which the sources list as through `7.8`","fix":"- Update ND Shortcodes For Visual Composer past `7.8` to the fixed release named by the vendor (the exact fixed version is unknown)","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:25+00:00","updated_at":"2026-10-25T03:47:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update ND Shortcodes For Visual Composer past `7.8` to the fixed release named by the vendor (the exact fixed version is unknown)","reach":"internet","title":"ND Shortcodes For Visual Composer: stored XSS through web page generation","impact":"medium","summary":"ND Shortcodes For Visual Composer, a WordPress plugin by nicdark, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can get script stored in page content can run it in the browser of anyone who views that page.","category":"package","nicknames":[],"who_cares":["wordpress","visual-composer","nd-shortcodes"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and the privilege level needed to store the payload from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114702.","how_to_check":"- Check the installed plugin version of `nd-shortcodes` in the WordPress admin under Plugins, or with `wp plugin get nd-shortcodes --field=version`\n- Compare the result against the affected range, which the sources list as through `7.8`","needs_analyst":true,"not_affected_if":["plugin-not-installed","trusted-editors-only"],"who_is_affected":"Sites running the ND Shortcodes For Visual Composer plugin at version 7.8 or earlier, the WordPress plugin used with Visual Composer. Exposure depends on who can add content that includes the plugin's shortcodes; sites where only trusted administrators edit pages carry less risk. Sites without this plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3368,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114702':14A,17A '-2026':13A,16A '7.8':108C 'affect':99C 'allow':44B,95C 'anyon':67B 'attack':51B 'browser':65B 'compos':5A,24B,30B,91C,104C 'content':59B 'cross':47B,81C 'cross-sit':46B,80C 'cve':12A,15A 'fail':36B 'generat':11A,41B,79C 'get':54B 'improp':72C 'input':39B,75C 'issu':98C 'n/a':106C 'nd':1A,19B,26B,87C,93C,100C 'nd-shortcod':18B,92C 'neutral':38B,73C 'nicdark':35B,86C 'packag':21B 'page':10A,42B,58B,71B,78C 'plugin':33B 'run':61B 'script':49B,55B,83C 'shortcod':2A,20B,27B,88C,94C,101C 'site':48B,82C 'store':6A,45B,56B,96C 'view':69B 'visual':4A,23B,29B,90C,103C 'visual-compos':22B 'vulner':84C 'web':9A,77C 'wordpress':25B,32B 'xss':7A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ND Shortcodes For Visual Composer plugin at version 7.8 or earlier, the WordPress plugin used with Visual Composer. Exposure depends on who can add content that includes the plugin's shortcodes; sites where only trusted administrators edit pages carry less risk. Sites without this plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114702","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114702","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114702","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}