CVE-2025-49928

CVE-2025-49928 concerns CrocoBlock JetWooBuilder (WordPress plugin) with a DOM-based XSS vulnerability in jet-woo-builder due to improper input neutralization during web page generation. Affected versions are up to and including 2.1.20. The issue could allow an attacker to inject script content i...

CVE-2025-11844

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...

CVE-2025-11844

Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...

CVE-2025-58961: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-addon allows DOM-Based XSS.This issue affects CF7 Auto Responder Addon: from n/a through = 2.4...

CVE-2025-49936: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through 8.3.2...

PT-2025-43187

Name of the Vulnerable Software and Affected Versions Seriously Simple Podcasting versions through 3.11.1 Description The software contains a flaw related to improper input handling during web page creation, which allows for Cross-site Scripting XSS. This specific instance is a DOM-Based XSS issu...

CVE-2025-49923: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through = 3.11.1...

WordPress plugin Seriously Simple Podcasting 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2025-49928: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through = 2.1.20...

CVE-2025-49940: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through = 3.13.2...

Multiple Password Managers Vulnerable to Clickjacking Attacks

Overview Browser-extension password managers, which autofill sensitive information on websites, can be exposed to various clickjacking attacks. These attacks exploit the trust relationship between a web page and the user-interface elements injected by the extension. Recent studies show that...

CVE-2025-49553

Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted we...

Prototype Pollution

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Prototype Pollution via the shared process between untrusted scripts...

nuxt-spec (>=0.1.10, <=0.1.11) potentially affected by CVE-2025-62410 via happy-dom (20.0.0)

happy-dom NPM version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on happy-dom and may be impacted: - nuxt-spec =0.1.10, =0.1.11 Source cves: CVE-2025-62410 Source advisory: SNYK:JS-HAPPYDOM-13559227...

Prototype Pollution

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Prototype Pollution via the shared process between...

GHSA-QPM2-6CQ5-7PQ5 happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Summary The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads. Details The untrusted script and the rest of the application still run in the same Isolate/process, s...

EUVD-2025-34678

happy-dom's --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript...

@happy-dom/global-registrator (>=19.0.0, <=19.0.2), @happy-dom/jest-environment (>=19.0.0, <=19.0.2) +4 more potentially affected by CVE-2025-62410 via happy-dom (>=19.0.2, <=20.0.0)

happy-dom NPM version =19.0.2, =19.0.0, =19.0.0, =19.0.0, =1.0.0, =0.1.9, =1.1.81, =1.1.82 Source cves: CVE-2025-62410 Source advisory: OSV:GHSA-QPM2-6CQ5-7PQ5...

CVE-2025-62410

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads ...

CVE-2025-62410 --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads ...