MAL-2026-17479 Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

MAL-2026-17475 Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

CVE-2026-1661: Improper Neutralization of Input During Web Page Generation

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

PYSEC-2026-4171 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Summary Before tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset,...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

SummaryBefore tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset, ...

PYSEC-2026-4170 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

CVE-2026-14995

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-90560

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-14995

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.15.1 . The root cause is insufficient input sanitization and output escaping when handling the REQUEST_URI Path . An unauthenticated attacker can inject arbitrary web sc...