WordPress Ultra Skype Button plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'btnid' Shortcode Attribute vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Ultra Skype Button versions = 1.0...

XSS in Bootstrap button component

...

EUVD-2025-199070

Malicious code in itobuz-angular-button npm...

Malicious code in itobuz-angular-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1e5a2f36eaf45beca864b2fa27d356d6d087ab2083dae3a6fab3dc08561357 The package itobuz-angular-button was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190973 Malicious code in itobuz-angular-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1e5a2f36eaf45beca864b2fa27d356d6d087ab2083dae3a6fab3dc08561357 The package itobuz-angular-button was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199073

Malicious code in ito-button npm...

Malicious code in ito-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9cf5ba13f206c5d1d757c2cf05286ee560131e1fcb7075df3f36ebb148077f3 The package ito-button was found to contain malicious code. Source: ghsa-malware 03f8f135ee783bb27854daa06728ae760fbffe751ad120740d501a29f4b1a68a Any...

MAL-2025-190970 Malicious code in ito-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9cf5ba13f206c5d1d757c2cf05286ee560131e1fcb7075df3f36ebb148077f3 The package ito-button was found to contain malicious code. Source: ghsa-malware 03f8f135ee783bb27854daa06728ae760fbffe751ad120740d501a29f4b1a68a Any...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

CVE-2025-11265

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnitctaurl' and 'vkExUnitctabuttontext' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks...

CVE-2025-11265 VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnitctaurl' and 'vkExUnitctabuttontext' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks...

CVE-2025-11265 VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnitctaurl' and 'vkExUnitctabuttontext' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks...

WordPress Save as PDF Button plugin cross-site scripting vulnerability

The WordPress Save as PDF Button plugin is a tool that adds one-click PDF generation functionality to WordPress websites, allowing visitors to save web content e.g., articles, product pages, etc. as PDF files with the click of a button. WordPress Save as PDF Button plugin has a cross-site scripti...

PT-2025-47247

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.1 Description The software is susceptible to Stored Cross-Site Scripting through the vkExUnit cta url and vkExUnit cta button text parameters. This is caused by a logic...

CLSA-2025-1763124505 xorg-x11-server-Xwayland: Fix of CVE-2023-6816

CVE-2023-6816: fix heap buffer overflow in logical button map allocation, allocate sufficient space for maximum button mappings up to 255...

CVE-2025-8397

The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8397

The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8397

The CVE concerns the WordPress plugin Save as PDF Button. All versions up to 1.9.2 are vulnerable to Stored Cross-Site Scripting via the restpackpdfbutton shortcode due to insufficient sanitization/escaping of user attributes. Authenticated attackers with contributor-level access (or higher) can ...

CVE-2025-8397 Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode

The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...