WordPress Calendar Plus plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Calendar Plus versions = 1.2.4...

[SECURITY] Fedora 41 Update: civetweb-1.16-9.fc41

Civetweb is an easy to use, powerful, C C/C++ embeddable web server with optional CGI, SSL and Lua support. CivetWeb can be used by developers as a library, to add web server functionality to an existing application. It can also be used by end users as a stand-alone web server running on a Window...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-8689

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-8689

CVE-2025-8689 : Elements Plus! for WordPress is vulnerable to Stored Cross‑Site Scripting in versions up to 2.16.4 via the plugin’s Image Comparison, HotSpot Plus, and Google Maps widgets. An authenticated attacker with contributor+ privileges can inject scripts that execute when users load an in...

CVE-2025-8689 Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Elements Plus! plugin <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Elements Plus! versions = 2.16.4...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

PT-2025-37136

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress plugin Elements Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

Linux Distros Unpatched Vulnerability : CVE-2020-13881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In support.c in pamtacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. CVE-2020-13881 Not...

1997ckf-ui-comp (>=0.0.9 <=0.0.17), 1data-business (>=0.0.1 <=0.0.3) +6013 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0 <=2.9.9)

element-plus NPM version =1.0.1-beta.0, =0.0.9, =0.0.1, =1.0.0, =0.1.11, =0.1.0, =1.0.0, =0.3.1, =1.0.0-beta.0, =1.0.0, =0.0.1-alpha.10, =1.0.6, =0.1.20, =0.1.27 and more Source cves: CVE-2025-57665 Source advisory: SNYK:JS-ELEMENTPLUS-12670415...

@17mkh/ui (=0.0.2), @acedatacloud/nexior (>=3.72.0 <=3.274.2) +691 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0 <=2.11.0)

element-plus NPM version =1.0.1-beta.0, =3.72.0, =2.0.1, =0.0.1, =0.0.1, =0.0.1, =0.6.6, =0.3.3, =0.0.1, =0.0.1, =0.1.15, =0.0.1, =0.0.4-alpha.8 and more Source cves: CVE-2025-57665 Source advisory: OSV:GHSA-5M5X-9J46-H678...

Improper Encoding or Escaping of Output

Overview element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious...

GHSA-5M5X-9J46-H678 Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...