Nicdark
12 CVEs across 12 Nicdark products. Browse Nicdark vulnerabilities, severities, and proof-of-concept exploits.
Nicdark products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-63001 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-53259 | High | 7.5 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2025-47498 | High | 7.5 | 2025-05-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2025-39526 | High | 8.1 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2024-37223 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS… |
CVE-2024-5348 | High | 8.8 | 2024-06-01 | The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' at… |
CVE-2024-5220 | Medium | 6.4 | 2024-05-25 | The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 d… |
CVE-2024-1382 | High | 8.8 | 2024-03-07 | The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_rst_layout attribut… |
CVE-2023-51403 | Medium | 6.5 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This is… |
CVE-2023-1273 | High | 8.8 | 2023-07-04 | The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, all… |
CVE-2022-4623 | Medium | 5.4 | 2023-07-04 | The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2023-0165 | Medium | 5.4 | 2023-03-06 | The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2023-1155 | Medium | 6.4 | 2023-03-02 | The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and inc… |
CVE-2022-29443 | Medium | 4.1 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPres… |
CVE-2022-27859 | Medium | 4.1 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at… |
CVE-2022-29433 | Medium | 4.1 | 2022-05-13 | Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress. |
CVE-2021-24821 | Medium | 5.4 | 2022-03-07 | The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Descripti… |