PT-2026-104491

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-85002

The EmbedPress WordPress plugin, in versions before 4.6.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape one of its block attributes before outputting it inside an HTML attribute, specifically identified in the Instagram Carousel Block Attributes . ...

Malicious Package

Overview epic-react-carousel is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

PT-2026-97673

Name of the Vulnerable Software and Affected Versions Drupal Diba carousel slider versions 0.0.0 through 3.0.2 Description Stored Cross-site Scripting XSS occurs when the "Allow HTML description" option is enabled. In this configuration, slide descriptions are rendered using the raw stored field...

WordPress Slider Bootstrap Carousel plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Slider Bootstrap Carousel versions = 1.0.7...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54623 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54623 Source advisory: OSV:PYSEC-2026-3822...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54624 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54622 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-61663 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-61663 Source advisory: OSV:PYSEC-2026-3823...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-63003 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-63003 Source advisory: OSV:PYSEC-2026-3821...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-63003 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...

CVE-2026-78149

The Smart Post WordPress plugin (versions 4.0.0-4.0.7 ) contains a vulnerability where it fails to verify if a post is password protected before returning its content and stored password via an unauthenticated AJAX action (specifically via sp_handle_post_id). This allows unauthenticated users to ...

CVE-2026-78149 Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-81160

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...