WordPress Page Layout builder v1.9.3 - Cross-Site Scripting

WordPress plugin Page-layout-builder v1.9.3 contains a cross-site scripting vulnerability. id: CVE-2016-1000141 info: name: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress plugin Page-layout-builder v1.9.3 contains a cross-site...

DRUPAL-CONTRIB-2026-123

This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...

WordPress YMC Filter plugin < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema vulnerability

Contributor+ Stored XSS via Layout Builder Schema vulnerability discovered by Usama Arshad in WordPress Plugin Filter & Grids versions 3.12.8...

WordPress YMC Filter cross-site scripting vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. The WordPress YMC Filter has a cross-site scripting vulnerability. This vulnerability stems from the lack of object ownership verification during the saving of layout builders, as well as the...

CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

CVE-2026-16558

The YMC Filter WordPress plugin (versions before 3.12.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a layout builder setting before outputting it on public endpoints, combined with a lack of object ownership verification when saving ...

CVE-2026-16558: Improper Neutralization of Input During Web Page Generation

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

PT-2026-63406

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

DRUPAL-CORE-2026-012

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...

PT-2026-60391

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...

Drupal 10.6.x < 10.6.13 / 11.3.x < 11.3.14 / 11.4.x < 11.4.4 Multiple Vulnerabilities (drupal-2026-07-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.13, 11.3.x prior to 11.3.14, or 11.4.x prior to 11.4.4. It is, therefore, affected by multiple vulnerabilities. - Drupal core 11.2 and above integrate the HTMX JavaScript librar...

Cross-site Scripting (XSS)

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Layout Builder module, which does not sufficiently sanitize block labels in certain scenarios. ...

EUVD-2016-1085

Malware in sbrugna...

EUVD-2025-25045

Malicious code in bioql PyPI...

CVE-2025-8996

Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0...

CVE-2025-8996

Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0...

CVE-2025-8996

The Drupal Layout Builder Advanced Permissions module (versions 0.0.0 to 2.1.9 ) is vulnerable to a Missing Authorization issue, which allows for Forceful Browsing . The root cause is that the module does not sufficiently control access for adding sections in the submodule. While an attacker must...

CVE-2025-8996 Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097

Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0...