34 matches found
WordPress ND Shortcodes For Visual Composer Plugin < 7.0 is vulnerable to Cross Site Scripting (XSS)
Software ND Shortcodes For Visual Composer Type Plugin Vulnerable versions 7.0 Fixed in 7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4623 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dd667622b492 Credits István Márto...
PT-2023-14869 · WordPress · Nd Shortcodes
Name of the Vulnerable Software and Affected Versions: ND Shortcodes WordPress plugin versions prior to 7.0 Description: The issue is related to the lack of validation and escaping of numerous shortcode attributes in the ND Shortcodes WordPress plugin. This could allow users with the contributor...
CVE-2023-1273: Undefined Security Weakness
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks...
CVE-2022-4623: Undefined Security Weakness
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WordPress ND Shortcodes For Visual Composer Plugin < 7.0 is vulnerable to Local File Inclusion
Software ND Shortcodes For Visual Composer Type Plugin Vulnerable versions 7.0 Fixed in 7.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-1273 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0d5d6aec821b Credits Erwan LR WPScan Required...
ND Shortcodes < 7.0 - Subscriber+ LFI
The plugin does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks Run the below command in the developer console of the web browser while being on the blog as a...
WordPress nd-shortcodes plugin unauthorized operation vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nd-shortcodes is a drag-and-drop page builder plugin used in it. A security vulnerability exists in WordPress nd-shortcodes plugin...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
Summary: CVE-2019-15771 affects the WordPress plugin “nd-shortcodes” prior to version 6.0. A nopriv_ AJAX action in the plugin allows modification of the siteurl setting. Impact (as stated): This could enable an unauthenticated/privilege-abuse scenario by changing WordPress site URL related confi...
PT-2019-14380
Name of the Vulnerable Software and Affected Versions nd-shortcodes plugin versions prior to 6.0 Description The issue allows modification of the siteurl setting through a nopriv AJAX action. Recommendations For nd-shortcodes plugin versions prior to 6.0, update to version 6.0 or later to resolve...