WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Custom Dashboard Page versions = 1.0...

Malicious code in custom-networking-behavior (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dedb90c1c56915749973ff86ebfc51df188796ca9c8ca7a27e30a0434d19c9ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2250 Malicious code in custom-networking-behavior (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dedb90c1c56915749973ff86ebfc51df188796ca9c8ca7a27e30a0434d19c9ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-28912

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28895

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through = 2.1...

CVE-2025-28912 WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28912

Summary of CVE-2025-28912 (CSRF) — WordPress Custom Dashboard Page plugin Affected product: WordPress Custom Dashboard Page plugin (versions up to 1.0). Issue: Cross-Site Request Forgery (CSRF) vulnerability described in multiple sources (NVD/Red Hat/CVE records). Root cause: CSRF vulnerability a...

CVE-2025-28895 WordPress Custom top bar plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through = 2.1...

CVE-2025-28895 WordPress Custom top bar plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through = 2.1...

CVE-2025-28895

CVE-2025-28895 concerns the WordPress plugin “Custom top bar” (sumanbiswas013) up to version 2.0.2. The issue is described as a CSRF to Stored XSS vulnerability (Cross-site Scripting) arising from improper input handling during web page generation. The CVSS3.1 vector denotes: Network attack, Low ...

jinja2: Jinja has a sandbox breakout through indirect reference to format method

A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

WordPress Plugin Custom Dashboard Page Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin “Custom Top Bar” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-10947

Name of the Vulnerable Software and Affected Versions: Muntasir Rahman Custom Dashboard Page versions 1.0 and earlier Description: The issue is related to a cross-site request forgery CSRF problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker can trick a...

PT-2025-10935

Name of the Vulnerable Software and Affected Versions: sumanbiswas013 Custom top bar versions n/a through 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Stored XSS...

CVE-2025-28912: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28895: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through = 2.1...

firefox: Clickjacking the registerProtocolHandler info-bar Reporter

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol...

firefox: Clickjacking the registerProtocolHandler info-bar Reporter

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol...

firefox: Clickjacking the registerProtocolHandler info-bar Reporter

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol...