CVE-2026-114702 nicdark CVE debrief

Who should care

Defenders responsible for WordPress installations using the ND Shortcodes For Visual Composer plugin, especially those with versions up to 7.8, should assess their exposure and prioritize updating or mitigating the vulnerability.

Why it matters

CVE-2026-114702 is a Stored XSS vulnerability in the WordPress ND Shortcodes For Visual Composer plugin versions up to 7.8. Defenders should verify and update the plugin, monitor for suspicious activity, and implement additional security measures to prevent exploitation and mitigate potential impacts.

• Potential injection of malicious scripts into web pages viewed by other users.
• Possible exploitation through stored XSS, allowing for various malicious actions.
• Need for verification of plugin versions and updates to prevent exploitation.
• Importance of monitoring for suspicious activity related to the vulnerability.

Technical summary

The ND Shortcodes For Visual Composer plugin for WordPress, up to version 7.8, contains a Stored Cross Site Scripting (XSS) vulnerability. This vulnerability, identified as CVE-2026-114702, allows attackers to store malicious scripts that can be executed when other users access affected pages. The vulnerability is a result of improper neutralization of input during web page generation, leading to Stored XSS. Defenders should prioritize verifying and updating the ND Shortcodes For Visual Composer plugin to a version beyond 7.8, if available, and monitor for any suspicious activity related to stored XSS. The vulnerability affects versions of the plugin up to 7.8 and can lead to various malicious actions.

Defensive priority

Defenders should prioritize verifying and updating the ND Shortcodes For Visual Composer plugin to a version beyond 7.8, if available, and monitor for any suspicious activity related to stored XSS.

Recommended defensive actions

• Verify and update the ND Shortcodes For Visual Composer plugin to a version beyond 7.8, if available.
• Monitor for any suspicious activity related to stored XSS.
• Implement additional security measures to detect and prevent XSS attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions up to 7.8 of the ND Shortcodes For Visual Composer plugin and its classification as a Stored XSS vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.