CVE-2025-23205: Exposure of Resource to Wrong Sphere

nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomai...

nbgrader 安全漏洞

nbgrader is an open source notebook assignment and grading system from Project Jupyter. A security vulnerability exists in nbgrader that stems from the fact that nbgrader allows its content to be embedded in IFrames by default, and the default configuration of JupyterHub enablesubdomains = False...

Brave Desktop 1.74.48 Security Fixes

Fixed iframe download popup origin confusion as reported on HackerOne by syarif07. Upgraded Chromium to 132.0.6834.83 — refer to Google Chrome advisories for inherited CVEs...

WordPress plugin Skyword API Plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-1711 · WordPress · Skyword Api Plugin

Name of the Vulnerable Software and Affected Versions: Skyword API Plugin for WordPress versions up to, and including, 2.5.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'skyword iframe' shortcode due to insufficient input sanitization and output escaping on...

WordPress Auto iFrame plugin < 2.0 - Contributor+ XSS via Shortcode vulnerability

Contributor+ XSS via Shortcode vulnerability discovered by Bob Matyas in WordPress Plugin Auto iFrame versions 2.0...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151 Auto iFrame < 2.0 - Contributor+ XSS via Shortcode

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151 Auto iFrame < 2.0 - Contributor+ XSS via Shortcode

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-10151

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2025-1578 · WordPress · Auto Iframe

Name of the Vulnerable Software and Affected Versions: Auto iFrame WordPress plugin versions prior to 2.0 Description: The issue concerns the Auto iFrame WordPress plugin, where versions prior to 2.0 do not validate and escape some of its shortcode attributes before outputting them back in a page...

WordPress plugin Auto iFrame 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-10151: Improper Neutralization of Input During Web Page Generation

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-22545

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through = 1.2...

CVE-2025-22545

CVE-2025-22545: The iframe-to-embed vulnerability (sw-galati.ro iframe) allows Stored XSS when embedding the iframe. Affected: iframe-to-embed. Root cause: improper input neutralization during web page generation. Impact per provided metrics is Low in confidentiality, integrity, availability with...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw-galati.ro iframe to embed allows Stored XSS.This issue affects iframe to embed: from n/a through 1.2...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through = 1.2...

WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin iframe to embed versions = 1.2...

PT-2025-4536 · Unknown · Sw-Galati.Ro

Name of the Vulnerable Software and Affected Versions: sw-galati.ro iframe to embed versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS in the iframe to embed...