CVE-2026-114702 in ND Shortcodes for Visual Composer Plugin
Summary
by MITRE • 10/22/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability is classified under the CWE-79 standard within the Common Weakness Enumeration framework, which catalogs software weaknesses related to input validation and output encoding failures. The affected component is the ND Shortcodes For Visual Composer plugin for WordPress, a widely used tool that allows users to create complex layouts using shortcodes in conjunction with the Visual Composer page builder ecosystem. This particular vulnerability manifests as a Stored XSS issue, meaning that malicious scripts are not executed immediately upon input but are instead saved on the target server, typically within a database or content field, and subsequently served to other users when they view the affected page.
The technical root cause lies in the insufficient sanitization of user-supplied data before it is rendered into HTML by the application. When an attacker inputs malicious JavaScript code through any input field associated with the ND Shortcodes plugin that lacks proper encoding or escaping mechanisms, the web server accepts this payload without modification. Because the vulnerability allows for storage rather than just reflection, the impact is significantly more severe and persistent compared to reflected XSS attacks. Once stored, the script becomes part of the page content itself. Consequently, every user who accesses a webpage containing the compromised shortcode will have their browser execute the injected JavaScript in the context of the vulnerable site's domain.
From an operational perspective, this vulnerability poses critical risks to both end-users and website administrators. For visitors, successful exploitation can lead to session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users. It also enables credential theft through phishing overlays that mimic login forms, as well as defacement of the website’s appearance by altering DOM elements via script injection. Furthermore, advanced attacks could redirect victims to malicious sites designed for malware distribution or keylogging activities. For site owners and administrators, this represents a significant reputational risk and potential liability under data protection regulations if user data is compromised due to inadequate security controls within third-party plugins.
The ATT&CK framework categorizes such exploitation techniques under the T1059 sub-technique for Command and Scripting Interpretation, specifically focusing on browser-based execution via DOM manipulation or event handlers like onload or onclick attributes embedded in HTML tags. The persistence of stored XSS aligns with tactics involving initial access through compromised content and subsequent lateral movement if administrative privileges are obtained. This highlights the importance of treating user input as untrusted data regardless of its source within a web application environment, especially when dealing with rich text editors or shortcode generators that allow extensive formatting options.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary solution is to upgrade the ND Shortcodes For Visual Composer plugin to version 7.8 or later, where developers have presumably implemented proper input validation and output encoding practices consistent with OWASP guidelines. Until an update is applied, administrators should consider disabling the specific shortcodes that are vulnerable if they do not require their functionality. Additionally, implementing a Web Application Firewall can provide a layer of defense by filtering out known malicious payloads before they reach the application logic. Regular security audits and penetration testing focused on input validation across all user-facing forms will help identify similar weaknesses in other plugins or custom code integrated into the WordPress environment.