PT-2025-33526 · WordPress · Anber Elementor Addon

Name of the Vulnerable Software and Affected Versions: Anber Elementor Addon versions up to and including 1.0.1 Description: The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item'button link''url' parameter due to insufficient input sanitization...

CVE-2025-43734

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...

Malicious code in @cobalt-marketplace/react-stateful-button (npm)

The package @cobalt-marketplace/react-stateful-button was found to contain malicious code...

Malicious code in @sellerly-kit/button (npm)

The package @sellerly-kit/button was found to contain malicious code...

Malicious code in @frozen-ui/link-button (npm)

The package @frozen-ui/link-button was found to contain malicious code...

Malicious code in discords-button (npm)

The package discords-button was found to contain malicious code...

MAL-2025-40443 Malicious code in yelp-react-component-button (npm)

The package yelp-react-component-button was found to contain malicious code...

Malicious code in lyft-web-button (npm)

The package lyft-web-button was found to contain malicious code...

Malicious code in yelp-react-component-button (npm)

The package yelp-react-component-button was found to contain malicious code...

MAL-2025-37946 Malicious code in url-bar-notification-button (npm)

The package url-bar-notification-button was found to contain malicious code...

MAL-2025-9667 Malicious code in @wisetail/wds-button (npm)

The package @wisetail/wds-button was found to contain malicious code...

MAL-2025-7972 Malicious code in @frozen-ui/link-button (npm)

The package @frozen-ui/link-button was found to contain malicious code...

MAL-2025-7130 Malicious code in @cobalt-marketplace/react-stateful-button (npm)

The package @cobalt-marketplace/react-stateful-button was found to contain malicious code...

MAL-2025-25713 Malicious code in lyft-web-button (npm)

The package lyft-web-button was found to contain malicious code...

Malicious code in url-bar-notification-button (npm)

The package url-bar-notification-button was found to contain malicious code...

MAL-2025-18486 Malicious code in discords-button (npm)

The package discords-button was found to contain malicious code...

simple-basic-react-button (0.1.0) potentially affected by unknown CVE via prpo-types (0.0.1-security)

prpo-types NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on prpo-types and may be impacted: - simple-basic-react-button 0.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-30788...

MAL-2025-9296 Malicious code in @sellerly-kit/button (npm)

The package @sellerly-kit/button was found to contain malicious code...

CVE-2025-54694

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through = 1.2.0...

CVE-2025-54694

CVE-2025-54694 describes a Cross-Site Request Forgery in the WordPress plugin Button Block, affecting versions up to 1.2.0. The issue is confirmed in multiple sources and the CVE record shows a patch that updates beyond 1.2.0. Base metrics: CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N wit...