jotty.page < 1.22.0 - Path Traversal

jotty·page 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/filename, letting unauthenticated attackers read arbitrary files outside intended directory. id: CVE-2026-42564 info: name: jotty.page 1.22.0 - Path Traversal author: Het-Kalariya...

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting

The Easy Social Icons plugin = 3.0.8 for WordPress echoes out the raw value of $SERVER'PHPSELF' in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path...

CVE-2026-105259

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

CVE-2025-15701

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

CVE-2026-105259

The Easy Social Icons WordPress plugin, versions prior to 4.0.3 , is vulnerable to Stored XSS because it fails to sanitize SVG files during upload. Users with the Author role or higher can upload malicious SVGs containing XSS payloads. Additionally, if another installed version of the plugin expo...

EUVD-2026-117350

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

CVE-2025-15701

The Easy Social Icons WordPress plugin versions before 4.0.3 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape certain settings before displaying them on front-end pages. This allows high-privilege users, such as Administ...

EUVD-2025-211266

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is...

CVE-2026-121588

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

EUVD-2026-116036

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

Malicious code in @axon-web/icons (npm)

Source: amazon-inspector 579025dc4de76ecd9400215e99d550cb4579ab6eb7d78e4c3c91a2299ff59c91 On require, index.js constructs an identifier from os.hostname and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh/OAST...

MAL-2026-18433 Malicious code in @axon-web/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58 The package is advertised as an SVG icon library but, on require, runs an IIFE that constructs an identifier from os.hostname and...

Malicious code in @axon-web/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58 The package is advertised as an SVG icon library but, on require, runs an IIFE that constructs an identifier from os.hostname and...

CVE-2026-114532

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal UI Icons allows Cross-Site Scripting XSS. This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2...

CVE-2026-114527

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal UI Icons allows Cross-Site Scripting XSS. This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2...

CVE-2026-114527

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal UI Icons allows Cross-Site Scripting XSS. This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2...

CVE-2026-114527

The Drupal UI Icons module is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is that the module fails to sufficiently validate user-provided icon settings before they are rendered. This affects versions 0.0.0 to 1.1.3 an...

EUVD-2026-113551

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal UI Icons allows Cross-Site Scripting XSS. This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2...