CVE-2025-12590

The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it...

EUVD-2019-7977

Malware in sbrugna...

EUVD-2024-31638

Malicious code in bioql PyPI...

EUVD-2024-32304

Malicious code in bioql PyPI...

EUVD-2023-58031

Malicious code in bioql PyPI...

EUVD-2024-44444

Malicious code in bioql PyPI...

EUVD-2024-32320

Malicious code in bioql PyPI...

EUVD-2025-13663

Malicious code in bioql PyPI...

EUVD-2024-32383

Malicious code in bioql PyPI...

EUVD-2025-19257

Malicious code in bioql PyPI...

EUVD-2024-53963

Malicious code in bioql PyPI...

EUVD-2024-54446

Malicious code in bioql PyPI...

EUVD-2025-19861

Malicious code in bioql PyPI...

EUVD-2023-33810

Malicious code in bioql PyPI...

EUVD-2025-19548

Malicious code in bioql PyPI...

EUVD-2024-27894

Malicious code in bioql PyPI...

CVE-2025-4685

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This make...

CVE-2025-7658

The Temporarily Hidden Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'temphc-start' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6488

The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6540

The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above,...