CVE-2025-2537

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library version 3.1 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-53569

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-53569

CVE-2025-53569 covers a CSRF vulnerability in the Trust Payments Gateway for WooCommerce (JavaScript Library). The issue affects the plugin’s JavaScript library up to and including version 1.3.6. The connected sources consistently describe CSRF as the flaw, with no explicit exploit details provid...

CVE-2025-53569 WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-53569 WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-53569: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

WordPress plugin Trust Payments Gateway for WooCommerce (JavaScript Library) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Magnific Popups JavaScript Library < 1.2.0 - Contributor+ Stored XSS

Description Multiple plugins are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library version 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

GHSA-994J-5C83-R424 string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

string-math v1.2.2 was discovered to contain a Regex Denial of Service ReDoS which is exploited via a crafted input...

org.webjars.bowergithub.advanced-rest-client:code-mirror (2.0.1), org.webjars.bowergithub.angular-ui:ui-codemirror (>=0.1.6, <=0.3.0) potentially affected by CVE-2025-6493 via org.webjars.bowergithub.components:codemirror (>=4.13.0, <=5.65.12)

org.webjars.bowergithub.components:codemirror MAVEN version =4.13.0, =0.1.6, =0.3.0 Source cves: CVE-2025-6493 Source advisory: SNYK:JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-10494093...

com.gitblit.fathom:fathom-integration-test (>=0.5.0, <=1.0.1), com.github.dreampie:jfinal-dreampie (1.0) +30 more potentially affected by CVE-2025-6493 via org.webjars:codemirror (>=3.15, <=5.62.2)

org.webjars:codemirror MAVEN version =3.15, =0.5.0, =1.0.0, =1.0.1, =2.3.0.cr1, =2.1.8.0, =2.1.8.0, =2.1.8.0, =2.1.8.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =1.7.0, =1.7.5 and more Source cves: CVE-2025-6493 Source advisory: SNYK:JAVA-ORGWEBJARS-10494095...

CVE-2025-45526

A denial of service DoS vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content e.g., 100...

Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat

Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat By Trellix · June 18, 2025 This blog was also written by Trishaan Kalra Introduction What happens when a trusted open source library becomes a conduit for stealthy malware delivery? That question became reality when the...

GHSA-WGC6-9F6W-H8HX Withdrawn Advisory: microlight allows a denial of service

Withdrawn Advisory This advisory has been withdrawn because the proof of concept does not demonstrate a practical security impact. This link is maintained to preserve external references. Original Description A denial of service DoS vulnerability has been identified in the JavaScript library...

CVE-2025-45526

A denial of service DoS vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content e.g., 100...

CVE-2025-45526

The CVE-2025-45526 entry concerns microlight v0.0.7, where the reset function in microlight.js can consume excessive memory/CPU when processing extremely large content in elements with the microlight class. This can lead to browser crashes or unresponsiveness, effectively a DoS, with exploitation...

brace-expansion 安全漏洞

brace-expansion is a Brace extension in JavaScript by the individual developer Julian Gruber. A security vulnerability exists in brace-expansion version 1.1.11 and earlier, which stems from an inefficient regular expression complexity in the function expand...

CVE-2025-48370

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the...

CVE-2024-38989

izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...