Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ For educational purposes and authorized environments only. Functional PoC for vulnerability CVE-2022-47447, which affects a vulnerable WordPress plugin, allowing a Cross-Site Request Forgery CSRF attack against authenticated users. VULNERABLE URL:...

CVE-2026-110976

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

trellis-cve-2018-6389

trellis-cve-2018-6389 Mitigate CVE-2018-6389 WordPress load-scripts / load-styles attacks. Goal Why? Mitigation Why Not? Requirements Installation Trellis WordPress FAQs Can I use this on managed hosting? It looks awesome. Where can I find some more goodies like this? This isn't on wp.org. Where...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

MAL-2026-17874 Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

CVE-2026-62042

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

CVE-2026-62042 WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

EUVD-2026-95727

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

CVE-2026-62042

The Scripts n Styles WordPress plugin, versions 3.5.8 and below , is affected by a Broken Access Control vulnerability. This issue is caused by missing authorization checks, which allows for the exploitation of incorrectly configured access control security levels. The vulnerability results in a ...

WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Scripts n Styles versions = 3.5.8...

PT-2026-108879

Name of the Vulnerable Software and Affected Versions Scripts n Styles versions prior to 3.5.8 Description An authorization flaw in unFocus Projects Scripts n Styles allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than...

CVE-2026-62042: Missing Authorization

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

CVE-2025-60574

Descubridores de Vulnerabilidades y Autores de Exploits Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Descripción de la Vulnerabilidad Se ha identificado una vulnerabilidad de Inclusión de Archivos Locales LFI en tQuadra CMS 4.2.1117. El problema existe en la ruta "/styles/", que no...

MAL-2026-17524 Malicious code in tailwindcss-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 587d9a389f35a8ec2d3ed714c90f7daa43feb6875f4ce2e4280f5ce19569d895 The package name tailwindcss-forms-styles mimics the legitimate @tailwindcss/forms plugin, and its src/index.js copies that plugin's code verbatim as...

Malicious code in tailwindcss-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 587d9a389f35a8ec2d3ed714c90f7daa43feb6875f4ce2e4280f5ce19569d895 The package name tailwindcss-forms-styles mimics the legitimate @tailwindcss/forms plugin, and its src/index.js copies that plugin's code verbatim as...

Regular Expression Denial of Service (ReDoS)

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supp...

CVE-2026-105219

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...