Winter: Stored XSS through Editor Settings custom styles

Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...

Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

GHSA-V7CF-8GH9-GXMJ Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the custom styles process. An attacker can execute arbitrary scripts in the context of backend users by injecting malicious CSS that is not properly sanitized. This is only exploitable if the attacker has the...

CVE-2026-73422: Improper Neutralization of Input During Web Page Generation

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

WordPress Custom CSS and JavaScript data leakage vulnerabilities

WordPress Custom CSS and JavaScript allow for the addition of custom styles and interactive scripts through backend or plugins, without modifying the core theme files. This enables fine-tuning of the interface and expansion of functionality. However, WordPress Custom CSS and JavaScript have a dat...

PT-2026-76552

Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...

PT-2026-76553

Name of the Vulnerable Software and Affected Versions Winter versions 1.2.10 through 1.2.12 Description Authenticated backend users with the backend.manage editor permission can store custom Markup Styles via Settings → Editor Settings → Markup Styles. These styles are compiled by the LESS parser...

EUVD-2026-55975

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157 cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-73157

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

PT-2026-70083

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised remote server can control fields such as even...

Malware in post-css-transfer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview post-css-transfer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CLSA-2026-1786374683 TuxCare security update for postcss (1 CVE)

TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.4...

CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-50159

A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. An attacker who can provide diagram text can inject arbitrary CSS Cascading Style Sheets into the rendered web page. This is possible due to a vulnerability in how sibling combinator selectors are generated from...

CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...