9763 matches found
EUVD-2026-49232
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557
CVE-2026-65557 concerns the WordPress plugin Abandoned Cart Lite for WooCommerce (versions <= 6.8.0), where a Cross Site Scripting (XSS) flaw affects the shop-manager context. The connected records confirm the affected product (WordPress WooCommerce plugin), the vulnerability type (XSS), and t...
CVE-2026-65557 WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557 WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
PT-2026-64951
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65557: Improper Neutralization of Input During Web Page Generation
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Abandoned Cart Lite for WooCommerce versions = 6.8.0...
Malicious code in @daylightqc/date-fmt-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...
MAL-2026-11041 Malicious code in @daylightqc/date-fmt-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...
CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...
CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...
CVE-2025-9205
CVE-2025-9205 affects MapSVG Lite for WordPress up to version 8.14.0. The issue is a stored XSS vulnerability caused by insufficient input sanitization and output escaping on user-supplied map options attributes. It can be exploited by authenticated attackers with contributor-level access and abo...
CVE-2026-65697
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...
CVE-2026-65697
Fathom Lite (v1.3.1) has a stored XSS in the analytics collection endpoint (/collect). An unauthenticated user can supply crafted hostname and pathname to inject a javascript: URI, since parseHostname/parsePathname perform no URI scheme validation. The payload is stored and later rendered as an a...
CVE-2026-65697
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...