OWL Carousel Slider - Cross-Site Scripting

OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13627 info:...

WP Dream Carousel < 1.0.1b - Cross-Site Scripting

WP Dream Carousel WordPress plugin 1.0.1b contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires victim to load a...

Combo Blocks < 2.2.76 - Improper Access Control

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts id:...

Malicious code in sc-hydrate-carousel-price (npm)

Source: amazon-inspector fbcb760747e0ad33cc6bafa85914d99b141f5361c13c5c642122d1ea8f973d9f package.json declares a dependency ltidisafe whose source is a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.3.tgz rather than a registry version range. On npm install,...

CVE-2026-96382

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...

CVE-2026-96382

The Drupal Diba carousel slider (versions 0.0.0 through 3.0.2 ) is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is that when the "Allow HTML description" option is enabled, the component renders slide descriptions using raw stored field values. This bypasses Drupal's standard ...

CVE-2026-96382 Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...

EUVD-2026-107810

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...

CVE-2026-96382 Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...

CVE-2026-96382

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.0 . The root cause is insufficient input sanitization and output escaping within the update_license AJAX Action. This allows authenticated attackers with subscribe...

CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-104811

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

WordPress DiviGear Carousel plugin <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Austin Ginder in WordPress Plugin DiviGear Carousel versions = 5.2.0...

CVE-2026-107448

The Magic: The Gathering Arena Windows/Steam client (versions 2026.59.30.12801.127931.6 and certain 2026.60.x builds) is vulnerable to a Resource Injection flaw. The application fails to validate the URI scheme or domain of a server-supplied URL received from a home-screen carousel GoToExternalUr...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

EUVD-2026-91896

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92727: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...