CVE-2026-13712

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

EUVD-2026-59909

The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator,...

CVE-2026-13712

Divi WordPress theme versions 5.0 through 5.8.1 is vulnerable to contributor-level stored XSS via the Social Media Follow module's Skype URL field; malicious JavaScript stored by a low-privileged user executes when an administrator views the post. CVSS 5.4 medium. Patch to version 5.9.0. No in-th...

CVE-2026-16775 Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16775

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16775

The affected software is the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin. Affected versions: all versions up to and including 4.9.0. Vulnerability type: Stored Cross-Site Scripting via the 'id' Shortcode Attribute, caused by insufficient input sanitization and output...

CVE-2026-73045

creationtimestamp| type| source ---|---|--- 2026-08-16 00:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5uz564qo2o...

Malicious code in adxaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...

CVE-2026-48441

creationtimestamp| type| source ---|---|--- 2026-08-14 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mt2p4intoz2u...

CVE-2026-73635

creationtimestamp| type| source ---|---|--- 2026-08-14 10:24:15+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mszwwgaw2c23 2026-08-15 12:50:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/746ygwaxgtwpm 2026-08-15 13:36:32+00:00| seen|...

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post. Po...

CVE-2026-66478

creationtimestamp| type| source ---|---|--- 2026-08-13 16:40:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msy3hkgk7y2e...

CVE-2026-66454

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66454

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

EUVD-2026-57874

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66454

CVE-2026-66454 affects the WordPress WP Social Avatar plugin (versions

CVE-2026-15039

creationtimestamp| type| source ---|---|--- 2026-08-12 20:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvxc222lj2e...

CVE-2026-67285

creationtimestamp| type| source ---|---|--- 2026-08-12 14:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvdq7tpqe27 2026-08-12 15:42:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ddmpzgp7axc2j...

CVE-2026-66147

creationtimestamp| type| source ---|---|--- 2026-08-11 23:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstrgwb6cj2g 2026-08-12 00:45:39+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mstvnyyxdd2c 2026-08-12 01:57:31+00:00| seen|...