42671 matches found
Improper Check for Unusual or Exceptional Conditions
Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe's...
CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65540
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65537
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65535
Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...
CVE-2026-65524
Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...
CVE-2026-65526
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...
CVE-2026-65510
Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65503
Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65505
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65482
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3...
CVE-2026-65479
Subscriber Broken Access Control in Reviewer = 3.14.2 versions...
CVE-2026-65449
Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...
CVE-2026-65451
Contributor SQL Injection in MapSVG = 8.14.0 versions...
CVE-2026-59554
Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...
CVE-2026-59514
Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...
CVE-2026-59525
Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...