197 matches found
CVE-2025-48096
CVE-2025-48096 is a Missing Authorization/Broken Access Control vulnerability in the WordPress plugin “Custom CSS” (custom-css-editor) for versions up to and including 1.4.0. Public records from Red Hat and Patchstack confirm the issue stems from incorrectly configured access control, affecting t...
PT-2025-43158
Name of the Vulnerable Software and Affected Versions FRESHFACE Custom CSS versions through 1.4.0 Description An authorization issue exists in the FRESHFACE Custom CSS custom-css-editor, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update...
WordPress plugin Custom CSS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Custom CSS versions = 1.4.0...
EUVD-2021-11270
Malware in sbrugna...
EUVD-2021-11430
Malware in sbrugna...
EUVD-2017-11468
Malware in sbrugna...
EUVD-2021-11442
Malware in sbrugna...
EUVD-2019-15552
Malware in sbrugna...
EUVD-2018-17090
Malware in sbrugna...
EUVD-2018-3517
Malware in sbrugna...
EUVD-2023-32715
Malicious code in bioql PyPI...
EUVD-2024-43300
Malicious code in bioql PyPI...
EUVD-2024-36480
Malicious code in bioql PyPI...
EUVD-2025-10640
Malicious code in bioql PyPI...
EUVD-2025-3260
Malicious code in bioql PyPI...
CVE-2025-5699
The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2025-5699
CVE-2025-5699 involves the Developer Formatter WordPress plugin. A stored cross-site scripting (XSS) flaw exists in Custom CSS handling across all versions up to 2015.0.2.1, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated admin-level access and c...
CVE-2024-49230
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through = 2.0.4...
CVE-2024-7410
The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file...