4090 matches found
CVE-2025-5123 Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter
The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-5123: Improper Neutralization of Input During Web Page Generation
The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Malware in style-value-parser
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in vite-plugin-style-svg
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-4518 Malicious code in vite-plugin-style-svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a088c782de4d11381b6ebcd1c8b473f9d44157fc43c0e1cf01d289370f67c1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in style-beautify-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8c7477260a4838812ce1ffefa15867a9cc2252be7e06ec8f060d4fb919d757d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in style-beautify-plugins
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-4510 Malicious code in style-beautify-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8c7477260a4838812ce1ffefa15867a9cc2252be7e06ec8f060d4fb919d757d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in style-value-parser (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b01a73e3e81e6d1272878f4d16c5a569e2773f609a5fbf17dba53b3d56127963 Any computer that has this package installed or running should be considered...
MAL-2025-4580 Malicious code in style-value-parser (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b01a73e3e81e6d1272878f4d16c5a569e2773f609a5fbf17dba53b3d56127963 Any computer that has this package installed or running should be considered...
CVE-2025-20072
Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...
CVE-2025-22823
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jtwerdy Genesis Style Shortcodes genesis-style-shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through = 1.0...
CVE-2024-1328
The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and...
CVE-2024-25006
XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...
CVE-2024-4623
The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2024-23640
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.3 and 2.24.0 that enables an authenticated administrator with workspace-level privileges to store a...
CVE-2024-1466
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sliderstyle’ attribute of the Posts Multislider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2023-0467
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing...