CVE-2026-66683 WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2026-66683 WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2026-66683

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom CSS and JavaScript versions = 2.0.16...

CVE-2026-68747: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-68749: Inefficient Regular Expression Complexity

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

PT-2026-68626

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An unauthenticated remote attacker can cause server CPU exhaustion by providing a long CSS declaration within sanitized HTML. The issue resides in the HtmlSanitizeEx.Scrubber.CSS.scrub/...

PT-2026-68584

Name of the Vulnerable Software and Affected Versions Custom CSS and JavaScript versions prior to 2.0.17 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 2.0.16...

PT-2026-68625

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.3 Description An injection flaw exists in the CSS scrubber of the software, allowing an unauthenticated remote attacker to inject CSS at-rules, such as importing remote stylesheets, into pages served...

CVE-2026-66683: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

EulerOS 2.0 SP15 : emacs (EulerOS-SA-2026-2922)

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector...

CVE-2026-50159: Improper Control of Generation of Code

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

PT-2026-68752

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 10.9.8 Mermaid versions prior to 11.16.1 Description Mermaid is vulnerable to CSS injection through sibling combinator selectors generated from class or id names provided in the diagram text. The software fails to ful...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from string-split-obfuscated hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-13274 Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

Malware in babel-plugin-linaria-css-to-undefined

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ornikar/repo-config-react-legacy-css

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...