Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer… (CVE-2026-114702)

The vulnerability identified as CVE-2026-114702 affects nicdark ND Shortcodes For Visual Composer, specifically versions up to 7.8. It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial disclosure of confidential information, modification of data, and disruption of service availability. The impact is rated medium based on the CVSS score of 6.5.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and output encoding controls as temporary mitigations to reduce the risk of stored XSS.