MAL-2025-11047 Malicious code in @zalastax/nolb-css-d (npm)

The package @zalastax/nolb-css-d was found to contain malicious code...

MAL-2025-17797 Malicious code in css-sifymodules (npm)

The package css-sifymodules was found to contain malicious code...

MAL-2025-15810 Malicious code in blaze-optimize-css-assets-webpack-plugin-cosmogenic-joviology (npm)

The package blaze-optimize-css-assets-webpack-plugin-cosmogenic-joviology was found to contain malicious code...

MAL-2025-26421 Malicious code in mini-css-extract-plugin-buffer-bellatrix-selenium (npm)

The package mini-css-extract-plugin-buffer-bellatrix-selenium was found to contain malicious code...

MAL-2025-18278 Malicious code in dendrochronology-browserify-cosmiconfig-optimize-css-assets-webpack-plugin (npm)

The package dendrochronology-browserify-cosmiconfig-optimize-css-assets-webpack-plugin was found to contain malicious code...

MAL-2025-25594 Malicious code in loopback-css-loader-sagitta-terraforming (npm)

The package loopback-css-loader-sagitta-terraforming was found to contain malicious code...

Malicious code in server-mini-css-extract-plugin-orogeny-spawn (npm)

The package server-mini-css-extract-plugin-orogeny-spawn was found to contain malicious code...

Malicious code in nucleosynthesis-halley-optimize-css-assets-webpack-plugin-nebula (npm)

The package nucleosynthesis-halley-optimize-css-assets-webpack-plugin-nebula was found to contain malicious code...

Malicious code in optimize-css-assets-webpack-plugin-odin-slides-izar (npm)

The package optimize-css-assets-webpack-plugin-odin-slides-izar was found to contain malicious code...

Malicious code in sadr-cache-optimize-css-assets-webpack-plugin-ursa (npm)

The package sadr-cache-optimize-css-assets-webpack-plugin-ursa was found to contain malicious code...

CVE-2025-3703: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This issue affects CSS & JavaScript Toolbox: from n/a through 12.0.3...

Linux Distros Unpatched Vulnerability : CVE-2020-26973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This...

WordPress HT Mega plugin path traversal vulnerability

WordPress HT Mega plugin is an Elementor page builder plugin designed for WordPress, offering over 100 custom widgets, 360+ preset modules, and a variety of templates for blogs, sliders, collapsible menus, and other page elements. A path traversal vulnerability exists in the WordPress HT Mega...

Linux Distros Unpatched Vulnerability : CVE-2022-31744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy...

Linux Distros Unpatched Vulnerability : CVE-2021-23996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could...

CVE-2025-7443: Unrestricted Upload of File with Dangerous Type

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the storejavascriptcache.php file in all versions up to, and including, 2.2.4...

CVE-2025-8151

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151

CVE-2025-8151 (HT Mega – Absolute Addons For Elementor) is a path traversal vulnerability in the WordPress plugin HT Mega up to version 2.9.1. The flaw resides in the save_block_css function and can be exploited by an authenticated user with Author+ privileges to create and delete CSS files in an...