The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject malicious script code that will be executed in the browsers of visitors viewing content that includes the vulnerable shortcodes. The flaw is a stored cross‑site scripting (XSS) flaw, categorized as CWE‑79, and can be exploited by injecting JavaScript into plugin‑managed content fields that are later rendered without proper escaping.

The flaw affects nicdark’s ND Shortcodes For Visual Composer WordPress plugin for all versions up to and including 7.8. Any WordPress installation that has installed this plugin and uses its shortcodes is susceptible, regardless of site configuration.

The CVSS score is 6.5, indicating a moderate severity. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely through the plugin’s admin interface, where an authenticated user can create or edit shortcodes that are stored in the database. Once an attacker injects malicious code, all visitors to the affected pages will execute the script in their browsers, leading to credential theft, defacement, or further attacks.