Skip to content
OpenAdvisories

Vendor

nicdark

15 known vulnerabilities.

Products

Hotel Booking 6 Restaurant Reservations 3 Hotel Booking (WordPress plugin) 1 Cost Calculator 1 ND Shortcodes 1 Donations (WordPress plugin) 1 Elements For Elementor 1 ND Shortcodes For Visual Composer 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-118084

    WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

    nicdark Hotel Booking
  • Medium 6.5
    CVE-2026-114702

    WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.

    nicdark ND Shortcodes For Visual Composer
  • Medium 5.3
    CVE-2025-63001

    WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.

    nicdark Hotel Booking
  • Medium 6.5
    CVE-2024-37223

    WordPress Restaurant Reservations plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 2.0.

    nicdark Restaurant Reservations
  • Medium 6.4
    CVE-2024-5220

    ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting

    The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated …

    nicdark ND Shortcodes Web / CMS
  • Medium 6.5
    CVE-2023-51403

    WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 1.8.

    nicdark Restaurant Reservations
  • Medium 6.4
    CVE-2023-1155

    Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for a…

    nicdark Cost Calculator Web / CMS
  • Medium 4.1
    CVE-2022-29443

    WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.

    nicdark Hotel Booking (WordPress plugin) Web / CMS
  • Medium 4.1
    CVE-2022-29433

    https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability

    Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress.

    nicdark Donations (WordPress plugin) Web / CMS