PT-2026-81061

Name of the Vulnerable Software and Affected Versions SiteLeads versions prior to 1.2.1 Description Unauthenticated sensitive data exposure exists in the Lead Generation Contact Widget & AI Chatbot, affecting the Chat Button, Phone Call, Telegram, and Email features. Recommendations Update to a...

Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

Malicious Package

Overview stillm4ddpocs-demo-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in stillm4ddpocs-demo-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...

MAL-2026-14360 Malicious code in stillm4ddpocs-demo-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...

WordPress Royal Elementor Addons plugin < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder vulnerability

Admin+ Remote Code Execution via Widget Builder vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

CVE-2026-74982

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Widget component...

SUSE CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

SUSE CVE-2026-74982

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74978

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in the Widget component...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search parameter in the backend Table widget partial. An attacker can execute arbitrary scripts in the context of an authenticated backend user by enticing the user to follow a crafted link. This is only...

GHSA-HQ84-X37P-J6Q5 Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the evalImageTypeValue process. An attacker can inject arbitrary attributes, including event handlers, into the backend list by supplying specially crafted values that are rendered in an image column, leading...

GHSA-7MPF-4465-7FC2 Winter: Stored XSS through Backend List widget image columns

Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...