CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

CVE-2026-10827

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

WordPress Spectra Legacy plugin < 2.20.0 - Contributor+ Stored CSS Injection vulnerability

Contributor+ Stored CSS Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Spectra versions 2.20.0...

CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-10827

The Spectra Legacy (Ultimate Addons for Gutenberg) WordPress plugin before version 2.20.0 is vulnerable to Stored CSS Injection . The root cause is the failure to validate or escape several block style attributes when building CSS output for the front end. This allows users with the Contributor r...

PT-2026-67006

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2025-14469: Cross-Site Request Forgery (CSRF)

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

CVE-2026-10827: Insufficient Verification of Data Authenticity

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

WordPress Theme Editor plugin <= 3.1 - Cross-Site Request Forgery to CSS Modification vulnerability

Cross-Site Request Forgery to CSS Modification vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Editor versions = 3.1...

Chromium: CVE-2026-17843 Inappropriate implementation in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17845 Inappropriate implementation in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17878 Inappropriate implementation in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17827 Inappropriate implementation in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE CVE-2026-17797

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66997

Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions prior to 3.2 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to...

CVE-2026-17797

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514441966...

CVE-2026-17845

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518112775...

CVE-2026-17827

An inappropriate implementation flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517693726...

SUSE CVE-2026-17827

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17843

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...