CVE-2026-114184

The WPVibes Elementor Addon Elements plugin (specifically addon-elements-for-elementor-page-builder) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.14.4 . Exploitation details ar...

CVE-2026-114184 WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4...

WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Elementor Addon Elements versions = 1.14.4...

PT-2026-121288

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4...

CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

@mezo-org/mezo-clay (>=0.1.0-dev.0, <=0.1.0-dev.37), @mezo-org/passport (>=0.4.0-dev.6, <=0.18.0-dev.1) +4 more potentially affected by CVE-2026-114125 via @storybook/experimental-addon-test (8.6.14)

@storybook/experimental-addon-test NPM version 8.6.14 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/experimental-addon-test and may be impacted: - @mezo-org/mezo-clay =0.1.0-dev.0, =0.4.0-dev.6, =1.0.13, =1.0.2, =1.0.1, =1.0.6 Source cves:...

@cyberskill/shared (1.176.0) potentially affected by CVE-2026-114125 via @storybook/addon-vitest (9.0.6)

@storybook/addon-vitest NPM version 9.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/addon-vitest and may be impacted: - @cyberskill/shared 1.176.0 Source cves: CVE-2026-114125 Source advisory: GHSA-F2PH-CMG5-WXC8...

@cyberskill/shared (1.176.0) potentially affected by CVE-2026-114125 via @storybook/addon-vitest (9.0.6)

@storybook/addon-vitest NPM version 9.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/addon-vitest and may be impacted: - @cyberskill/shared 1.176.0 Source cves: CVE-2026-114125 Source advisory: SNYK:JS-STORYBOOKADDONVITEST-21689167...

@mezo-org/mezo-clay (>=0.1.0-dev.0, <=0.1.0-dev.37), @mezo-org/passport (>=0.4.0-dev.6, <=0.18.0-dev.1) +4 more potentially affected by CVE-2026-114125 via @storybook/experimental-addon-test (8.6.14)

@storybook/experimental-addon-test NPM version 8.6.14 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/experimental-addon-test and may be impacted: - @mezo-org/mezo-clay =0.1.0-dev.0, =0.4.0-dev.6, =1.0.13, =1.0.2, =1.0.1, =1.0.6 Source cves:...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: SNYK:JS-STORYBOOKADDONVITEST-21689167...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, whi...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, whi...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: GHSA-F2PH-CMG5-WXC8...

@cyberskill/shared (1.176.0) potentially affected by CVE-2026-114125 via @storybook/addon-vitest (9.0.6)

@storybook/addon-vitest NPM version 9.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/addon-vitest and may be impacted: - @cyberskill/shared 1.176.0 Source cves: CVE-2026-114125 Source advisory: OSV:GHSA-F2PH-CMG5-WXC8...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: OSV:GHSA-F2PH-CMG5-WXC8...

@mezo-org/mezo-clay (>=0.1.0-dev.0, <=0.1.0-dev.37), @mezo-org/passport (>=0.4.0-dev.6, <=0.18.0-dev.1) +4 more potentially affected by CVE-2026-114125 via @storybook/experimental-addon-test (8.6.14)

@storybook/experimental-addon-test NPM version 8.6.14 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/experimental-addon-test and may be impacted: - @mezo-org/mezo-clay =0.1.0-dev.0, =0.4.0-dev.6, =1.0.13, =1.0.2, =1.0.1, =1.0.6 Source cves:...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

@cyberskill/shared (1.176.0) potentially affected by CVE-2026-114126 via @storybook/addon-vitest (9.0.6)

@storybook/addon-vitest NPM version 9.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/addon-vitest and may be impacted: - @cyberskill/shared 1.176.0 Source cves: CVE-2026-114126 Source advisory: MEND:CVE-2026-114126...

@mezo-org/mezo-clay (>=0.1.0-dev.0, <=0.1.0-dev.37), @mezo-org/passport (>=0.4.0-dev.6, <=0.18.0-dev.1) +4 more potentially affected by CVE-2026-114126 via @storybook/experimental-addon-test (8.6.14)

@storybook/experimental-addon-test NPM version 8.6.14 is affected by a known vulnerability. The following packages have a transitive dependency on @storybook/experimental-addon-test and may be impacted: - @mezo-org/mezo-clay =0.1.0-dev.0, =0.4.0-dev.6, =1.0.13, =1.0.2, =1.0.1, =1.0.6 Source cves:...