Unknown ND Shortcodes vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown ND Shortcodes, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2022-4623nicdarknd_shortcodes+2
EPSS score
0.44%
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks8.8CVE-2023-1273nicdarknd_shortcodes+2
EPSS score
1.68%
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks