EUVD-2025-176978

Malicious code in protractor-eclipse-ini-subscription npm...

EUVD-2025-175487

Malicious code in xerxes-perseus-antd-subscription npm...

EUVD-2025-176148

Malicious code in subscription-resonance-singularitarianism-procyon npm...

EUVD-2025-176826

Malicious code in quito-cryovolcano-nightwatch-subscription npm...

EUVD-2025-176835

Malicious code in query-regulus-bionics-subscription npm...

EUVD-2025-177126

Malicious code in plutology-ariel-subscription-meissa npm...

Malicious code in subscription-proxima-levels-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae0a4d1da9dccbfd49a0d5afe640d0eb483fd0d87be0ffb321142c0dec91f2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176150

Malicious code in subscription-playwright-public-carina npm...

EUVD-2025-177899

Malicious code in mensa-subscription-antares-csv npm...

EUVD-2025-176155

Malicious code in subscription-carina-standard-exec npm...

EUVD-2025-179065

Malicious code in eris-perseus-subscription-iota npm...

MAL-2025-187939 Malicious code in markdownlint-subscription-changelog-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c56be628301573592cc719e5e4c23f4290e8e35e1e080e461e66a3ab71b489a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176154

Malicious code in subscription-firebase-buffer-json npm...

EUVD-2025-177420

Malicious code in ora-release-it-ichnology-subscription npm...

CVE-2025-11994

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2025-124904

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11994

The CVE-2025-11994 entry refers to the WordPress Easy Email Subscription plugin (versions up to and including 1.3) with an unauthenticated stored XSS via the name parameter due to insufficient input sanitization and output escaping. Wordfence’s report confirms this as a real vulnerability affecti...

CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-12901

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...