Liferay Portal is vulnerable to XSS through its Commerce Search Result widget

Cross-site Scripting XSS vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload...

EUVD-2013-1750

Malware in sbrugna...

EUVD-2024-27056

Malicious code in bioql PyPI...

EUVD-2025-26919

Malicious code in bioql PyPI...

EUVD-2024-51380

Malicious code in bioql PyPI...

EUVD-2025-4290

Malicious code in bioql PyPI...

EUVD-2025-28368

Malicious code in bioql PyPI...

EUVD-2025-7381

Malicious code in bioql PyPI...

EUVD-2024-32224

Malicious code in bioql PyPI...

EUVD-2024-17254

Malicious code in bioql PyPI...

CVE-2025-57483

A reflected cross-site scripting XSS vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter...

CVE-2025-58248

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codefish Pinterest Pinboard Widget pinterest-pinboard-widget allows Stored XSS.This issue affects Pinterest Pinboard Widget: from n/a through = 1.0.7...

CVE-2025-58241 WordPress SnapWidget Social Photo Feed Widget Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget-wp-instagram-widget allows DOM-Based XSS.This issue affects SnapWidget Social Photo Feed Widget: from n/a through = 1.1.0...

CVE-2025-8360

CVE-2025-8360 : LA-Studio Element Kit for Elementor (WordPress) is vulnerable to Stored Cross-Site Scripting via multiple widgets. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling an authenticated attacker with contributor-level access or...

CVE-2025-8603

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-9659

A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /xportalassembledesigner/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been...

WordPress plugin Mesa Mesa Reservation Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-33717 · WordPress · Nexter Blocks

Name of the Vulnerable Software and Affected Versions: Nexter Blocks versions prior to 4.5.5 Description: The Nexter Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS via multiple widgets. Insufficient input sanitization and output escaping on user-supplied attributes...

CVE-2025-47867

A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations...

CVE-2025-49191

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to...