7678 matches found
CVE-2026-10827
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
EUVD-2025-210579
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2025-14469
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2025-14469
The Theme Editor WordPress plugin (up to v3.1) is affected by a Cross-Site Request Forgery due to missing nonce validation on the ms_update AJAX action. This allows unauthenticated attackers to modify child theme CSS styles via a forged request if an administrator is tricked into performing an ac...
CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2026-10827
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
WordPress Spectra Legacy plugin < 2.20.0 - Contributor+ Stored CSS Injection vulnerability
Contributor+ Stored CSS Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Spectra versions 2.20.0...
CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
CVE-2026-10827
The Spectra Legacy (Ultimate Addons for Gutenberg) WordPress plugin before version 2.20.0 is vulnerable to Stored CSS Injection . The root cause is the failure to validate or escape several block style attributes when building CSS output for the front end. This allows users with the Contributor r...
PT-2026-67006
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
CVE-2025-14469: Cross-Site Request Forgery (CSRF)
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...
CVE-2026-10827: Insufficient Verification of Data Authenticity
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...
WordPress Theme Editor plugin <= 3.1 - Cross-Site Request Forgery to CSS Modification vulnerability
Cross-Site Request Forgery to CSS Modification vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Editor versions = 3.1...
Chromium: CVE-2026-17827 Inappropriate implementation in CSS
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17878 Inappropriate implementation in CSS
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17843 Inappropriate implementation in CSS
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17845 Inappropriate implementation in CSS
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
SUSE CVE-2026-17797
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66997
Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions prior to 3.2 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to...
