7769 matches found
CVE-2025-9625 Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery
The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the mayberestrictcontent function. This makes it possible...
CVE-2025-9625
Affected software: WordPress Coil Web Monetization plugin. Vulnerability: Cross-Site Request Forgery due to missing/incorrect nonce validation on the coil-get-css-selector handling in the maybe_restrict_content function. Impact: Unauthenticated attackers can trigger CSS selector detection functio...
EUVD-2025-197947
The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the mayberestrictcontent function. This makes it possible...
CVE-2025-11267
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'veucustomcss' parameter in all versions up to, and including, 9.112.1. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. This makes i...
CVE-2025-11267
The VK All in One Expansion Unit WordPress plugin is affected by a Stored XSS in the _veu_custom_css value across versions up to 9.112.1. The vulnerability stems from insufficient input sanitization and output escaping, enabling authenticated attackers with Contributor-level access or higher to i...
CVE-2025-9625: Cross-Site Request Forgery (CSRF)
The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the mayberestrictcontent function. This makes it possible...
Mozilla Thunderbird < 52.5.2
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 52.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-30 advisory. - It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g...
PT-2025-47272
Name of the Vulnerable Software and Affected Versions Coil Web Monetization plugin for WordPress versions prior to 2.0.3 Description The software is susceptible to a Cross-Site Request Forgery CSRF issue. This is caused by inadequate nonce validation when handling the coil-get-css-selector...
EUVD-2025-179564
Malicious code in cors-relay-mini-css-extract-plugin-winston npm...
EUVD-2025-180399
Malicious code in apex-electron-protractor-mini-css-extract-plugin npm...
EUVD-2025-180273
Malicious code in async-css-minimizer-webpack-plugin-heka-redgiant npm...
Malicious code in hydrogeology-chariklo-pulsar-mini-css-extract-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d514e86e9a193b5e01631ae67c92d3d0e92c33b1e9cb062f76dee9edaf4a7576 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179887
Malicious code in canopus-odin-scorpius-css-minimizer-webpack-plugin npm...
EUVD-2025-177844
Malicious code in middleware-css-loader-eigenstate-pavo npm...
EUVD-2025-179063
Malicious code in eris-slidev-iota-css-minimizer-webpack-plugin npm...
EUVD-2025-177561
Malicious code in node-sass-nashira-xerxes-css-minimizer-webpack-plugin npm...
EUVD-2025-179465
Malicious code in css-loader-rehype-toml-version npm...
MAL-2025-190157 Malicious code in virgo-css-loader-whitedwarf-mongoose (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9e72821469ad969c599578140f8b08a5c150f3d3e646c199d211f9e05b669ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...