CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293

The Autopay WordPress plugin (also known as Blue Media for WooCommerce ) versions prior to 5.0.1 is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a failure to perform capability or nonce checks before saving a styling option from a public request, combined wi...

CVE-2026-17011

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-17011

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

EUVD-2026-54892

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

CVE-2026-17011: Insufficient Verification of Data Authenticity

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

CSS Injection

Mermaid is vulnerable to CSS Injection. The vulnerability is due to sibling combinator selectors generated from attacker-controlled diagram class or ID names, allowing CSS injection that can alter the appearance or behavior of unrelated page elements...

MAL-2026-13604 Malicious code in tailwindcss-motion-advanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b8426c39ffcba11d95e8ede8085ce260dbcf8527544ce9ca3a1d7a59618f0eb On require of the package's main entry, lib/utils.min.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org,...

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...

RUSTSEC-2026-0345 Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...

Malicious code in dpdgroup-css (npm)

Source: amazon-inspector 30c55e6b20286d3fc29d7c3bc24932180a5e94a6fe5147393d91da212fc0dc10 package.json declares both preinstall and postinstall lifecycle hooks that run node setup.js on every npm install. setup.js reads the installer's machine hostname via os.hostname and issues an HTTP GET to a...

Linux Distros Unpatched Vulnerability : CVE-2026-50159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CS...

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

Arbitrary Code Injection

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM...

Arbitrary Code Injection

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of...

GHSA-6X64-9X62-F2GX Mermaid allows CSS injection applying to sibling elements of the diagram

Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with mermaid-X, sibling and + combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram . Most users of mermaid would not be affected by this...

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...