CVE-2023-38483: Missing Authorization

Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4...

WordPress plugin WP Media Optimizer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PT-2024-17422 · WordPress · Wp Media Optimizer (.Webp) Plugin

Name of the Vulnerable Software and Affected Versions: WP Media Optimizer .webp plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...

CVE-2024-12060: Improper Neutralization of Input During Web Page Generation

The WP Media Optimizer .webp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources' parameters in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible...

Malicious code in readium-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e052a1c3b7fcfedb0cee689603d30bf043df8eebeff0146be74a4b0e218d62a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11171 Malicious code in readium-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e052a1c3b7fcfedb0cee689603d30bf043df8eebeff0146be74a4b0e218d62a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11330

The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-11330 Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting

The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2024-11330: Improper Neutralization of Input During Web Page Generation

The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrar...

PT-2024-16915 · WordPress · Custom Css

Name of the Vulnerable Software and Affected Versions: Custom CSS, JS & PHP plugin for WordPress versions up to, and including, 2.3.0 Description: The issue arises from the use of add query arg and remove query arg without proper escaping on the URL, leading to Reflected Cross-Site Scripting. Thi...

WordPress Custom CSS, JS & PHP plugin <= 2.3.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Custom CSS, JS & PHP versions = 2.3.0...

WordPress Custom CSS, JS & PHP Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Custom CSS, JS & PHP Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11330 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 56e1a6085112 Credits vgo0 Require...

WordPress Pure CSS Circle Progress bar plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Pure CSS Circle Progress Bar versions = 1.2...

CVE-2024-11385: Improper Neutralization of Input During Web Page Generation

The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circleprogress' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

PT-2024-16950

Name of the Vulnerable Software and Affected Versions Pure CSS Circle Progress bar plugin for WordPress versions up to, and including, 1.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'circle progress' shortcode due to insufficient input sanitization and output...

CVE-2024-52595

lxmlhtmlclean is a project for HTML cleaning functionalities copied from "lxml.html.clean". Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as "", "" and "". This behavior deviates from how web browsers parse and interpret such...

CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags...

CVE-2024-52595: Improper Neutralization of Input During Web Page Generation

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags...

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

CVE-2024-49230

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through = 2.0.4...