ND Shortcodes CVE-2026-114702

Exploitation requires an authenticated WordPress account with sufficient privileges to submit content through the ND Shortcodes For Visual Composer plugin (PR:L - a low-privilege role such as contributor/author, not an anonymous visitor), and a second victim who loads the page where the stored payload renders (UI:R). The exact plugin feature, shortcode parameter, or input field that fails neutralization is not described in the available sources. Limiting factors: the attacker must already hold a valid low-privilege login, the payload only fires when another user views the affected content, and impact is bounded to script execution in the victim's browser context (C:L/I:L/A:L). All versions from n/a through 7.8 are affected; no non-default configuration is stated as required.

This is a moderate-severity stored XSS (CVSS 6.5) in a WordPress plugin, carrying signals that point to limited rather than urgent real-world risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable but authenticated (PR:L) exploitation that additionally requires victim interaction (UI:R), with a scope change (S:C) reflecting the cross-origin nature of XSS and limited (L) confidentiality/integrity/availability impact. No EPSS score, KEV listing, SSVC automatability/technical-impact rating, or POC flag is present in the input; the only decision signal is vuln.today's 'this_month' priority, which aligns with a patch-on-normal-cycle posture rather than an emergency. The sole source is a single Patchstack advisory reported by audit@patchstack.com, so corroboration is thin. The authenticated requirement (PR:L - a logged-in low-privilege user such as a contributor/author) and the need for user interaction meaningfully constrain exploitation, making this a real-but-non-critical issue rather than a high-CVSS/low-real-risk mislabel. Note the two signals are consistent: both the CVSS metrics and the 'this_month' decision label indicate a routine-priority flaw, not active exploitation.

An authenticated low-privilege WordPress user (e.g. a contributor or author permitted to submit content through the plugin's shortcode/Visual Composer fields) injects a malicious script payload that is stored by the application. When an administrator or another visitor subsequently views the affected page, the script executes in their browser session. No public exploit code is identified in the provided data.