EUVD-2025-60953

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

Malicious code in double_narwhal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af8d548f854de75f608581cdd41e0602f4b136074932c56e9a0164676c29d41b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in double_harrier_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda59f8562b42f8a6ab09e17391e955e3816ded5663e7f23864f4180dd91cd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in double_badger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c030121ece1590ad5d190e7b3610443c32f622835fc4bdc081d43011e24554b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64456

Malicious code in doubleharerequirement npm...

EUVD-2025-64454

Malicious code in doublenarwhalz3n npm...

EUVD-2025-64455

Malicious code in doubleharrierz3n npm...

CVE-2025-12020

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-12020 Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-12020

The CVE-2025-12020 entry concerns the WordPress plugin Double the Donation. The connected documents provide concrete details: the plugin versions up to and including 2.0.0 are vulnerable to Stored Cross-Site Scripting via admin settings, caused by insufficient input sanitization and output escapi...

CVE-2025-12020 Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

MAL-2025-67851 Malicious code in double-sapphire-urial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c79e97c70da78e4693d25ab309a27639b45dba0167fc6a60f56695e0309373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54802

Malicious code in double-crimson-bee npm...

EUVD-2025-54797

Malicious code in double-white-barracuda npm...

EUVD-2025-54805

Malicious code in double-azure-flyingfish npm...

EUVD-2025-54804

Malicious code in double-azure-xerinae npm...

Malicious code in double-azure-flyingfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8e4137acf0eb6de7eae1bfaa6eaf2028de7954aae7bd777e86d4c03170e4ad4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54799

Malicious code in double-purple-lemming npm...

Malicious code in double-sapphire-urial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c79e97c70da78e4693d25ab309a27639b45dba0167fc6a60f56695e0309373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67848 Malicious code in double-gold-fish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 711bd25f8fc5bca780120047ef3f3a39a0a2f866b3cdf354cd0d8208bca499e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...