PT-2026-104112

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

WordPress Pro Like Button plugin < 2.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Pro Like Button versions 2.0...

CVE-2026-89296

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-90514

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89296 Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89296 Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89296

The Pro Like Button WordPress plugin, in versions before 2.0 , is vulnerable to SQL injection due to insufficient sanitization and escaping of a parameter before it is used in a SQL query. Specifically, the 'postid' parameter is identified as the vector. This flaw allows unauthenticated users to ...

PT-2026-103704

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89296: Improper Neutralization of Special Elements used in an SQL Command

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

Malicious Package

Overview @rutxploit-sec/waves-button-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

MAL-2026-17290 Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100639

SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...

EUVD-2026-87733

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

Malicious Package

Overview bnpl-blocks-mobile-bnpl-floating-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...