Filtered by vendor Nicdark
Subscribe
Total
9 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-5220 | 1 Nicdark | 1 Nd Shortcodes | 2025-04-04 | N/A | 6.4 MEDIUM |
| The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-0165 | 1 Nicdark | 1 Cost Calculator | 2025-03-06 | N/A | 5.4 MEDIUM |
| The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-51403 | 1 Nicdark | 1 Restaurant Reservations | 2024-11-21 | N/A | 6.5 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 1.8. | |||||
| CVE-2023-1273 | 1 Nicdark | 1 Nd Shortcodes | 2024-11-21 | N/A | 8.8 HIGH |
| The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks | |||||
| CVE-2023-1155 | 1 Nicdark | 1 Cost Calculator | 2024-11-21 | N/A | 6.4 MEDIUM |
| The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2022-4623 | 1 Nicdark | 1 Nd Shortcodes | 2024-11-21 | N/A | 5.4 MEDIUM |
| The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-29443 | 1 Nicdark | 1 Hotel Booking | 2024-11-21 | 3.5 LOW | 4.1 MEDIUM |
| Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress. | |||||
| CVE-2022-27859 | 1 Nicdark | 1 Nd-travel | 2024-11-21 | 3.5 LOW | 4.1 MEDIUM |
| Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at WordPress. | |||||
| CVE-2021-24821 | 1 Nicdark | 1 Cost Calculator | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page) | |||||