37 matches found
PT-2025-35009
Name of the Vulnerable Software and Affected Versions: dyiosah Ultimate twitter profile widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in dyiosah Ultimate twitter profile widget, which also allows Stored Cross-Site Scripting XSS. Recommendations: A...
Malicious code in risk-profile-widget (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6757 Malicious code in risk-profile-widget (npm)
The package communicates with a domain associated with malicious activity...
WordPress Card Elements for Elementor plugin <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Profile Card Widget vulnerability discovered by zer0gh0st in WordPress Plugin Card Elements for Elementor versions = 1.2.6...
CVE-2025-27320
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through = 4.3...
CVE-2025-27320
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through = 4.3...
WordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Profile Widget Ninja versions = 4.3...
CVE-2025-27320 WordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through = 4.3...
CVE-2025-27320
The CVE CVE-2025-27320 concerns WordPress Profile Widget Ninja with a DOM-based XSS due to improper input neutralization during web page generation. Affected are Profile Widget Ninja versions up to 4.3. Exploitation details are not provided in the documents; the issue is described as a cross-site...
CVE-2025-27320 WordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through = 4.3...
WordPress plugin Profile Widget Ninja 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...
PT-2025-7744 · Unknown · Profile Widget Ninja
Name of the Vulnerable Software and Affected Versions: Profile Widget Ninja versions through 4.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This can lead to Cross-site Scripting attacks. Recommendations: For...
MAL-2024-2889 Malicious code in pp-profile-widget (npm)
False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...
Malicious code in @zettle-bo/pp-profile-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1620f673435e4da925d2327f2d50d0ab0b66532cdb1d19d87accae90da85ac3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8201 Malicious code in @zettle-bo/pp-profile-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1620f673435e4da925d2327f2d50d0ab0b66532cdb1d19d87accae90da85ac3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
