Nicdark

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-5220 1Nicdark 1Nd Shortcodes Jun 17, 2026 May 25, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. Th...Show more The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-51403 1Nicdark 1Restaurant Reservations Jun 17, 2026 Feb 12, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 1.8.
CVE-2023-1273 1Nicdark 1Nd Shortcodes Jun 17, 2026 Jul 4, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform L...Show more The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacksShow less
CVE-2022-4623 1Nicdark 1Nd Shortcodes Jun 17, 2026 Jul 4, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co...Show more The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksShow less
CVE-2023-0165 1Nicdark 1Cost Calculator Jun 17, 2026 Mar 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the con...Show more The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-1155 1Nicdark 1Cost Calculator Jun 17, 2026 Mar 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output...Show more The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2022-29443 1Nicdark 1Hotel Booking Jun 17, 2026 Jun 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.
CVE-2022-27859 1Nicdark 1Nd Travel Jun 17, 2026 Jun 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at WordPress.
CVE-2021-24821 1Nicdark 1Cost Calculator Jun 17, 2026 Mar 7, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets i...Show more The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)Show less