51 matches found
WordPress Page Layout builder v1.9.3 - Cross-Site Scripting
WordPress plugin Page-layout-builder v1.9.3 contains a cross-site scripting vulnerability. id: CVE-2016-1000141 info: name: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress plugin Page-layout-builder v1.9.3 contains a cross-site...
DRUPAL-CONTRIB-2026-192
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
PT-2026-107742
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...
DRUPAL-CONTRIB-2026-123
This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...
PT-2026-84891
This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...
Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...
WordPress YMC Filter plugin < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema vulnerability
Contributor+ Stored XSS via Layout Builder Schema vulnerability discovered by Usama Arshad in WordPress Plugin Filter & Grids versions 3.12.8...
WordPress YMC Filter cross-site scripting vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. The WordPress YMC Filter has a cross-site scripting vulnerability. This vulnerability stems from the lack of object ownership verification during the saving of layout builders, as well as the...
CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...
CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...
CVE-2026-16558
The YMC Filter WordPress plugin (versions before 3.12.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to verify object ownership when saving layout builder settings, combined with a lack of proper sanitization and escaping before outputting those setting...
PT-2026-69172
Name of the Vulnerable Software and Affected Versions YMC Filter versions prior to 3.12.8 Description The plugin fails to sanitize and escape a layout builder setting before it is output on a public endpoint. Additionally, the software does not verify object ownership when the setting is saved...
CVE-2026-16558: Improper Neutralization of Input During Web Page Generation
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...
PT-2026-63406
Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description The internal LayoutBuilder control processes client-state XML without disabling Document Type Definition DTD processing. This allows an unauthenticated attacker to cause a denial of...
DRUPAL-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...
Drupal 10.6.x < 10.6.13 / 11.3.x < 11.3.14 / 11.4.x < 11.4.4 Multiple Vulnerabilities (drupal-2026-07-15)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.13, 11.3.x prior to 11.3.14, or 11.4.x prior to 11.4.4. It is, therefore, affected by multiple vulnerabilities. - Drupal core 11.2 and above integrate the HTMX JavaScript librar...
PT-2026-60391
Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0...
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting XSS vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface...
Cross-site Scripting (XSS)
Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Layout Builder module, which does not sufficiently sanitize block labels in certain scenarios. ...
