1351 matches found
EUVD-2026-91911
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...
WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting
The Easy Social Icons plugin = 3.0.8 for WordPress echoes out the raw value of $SERVER'PHPSELF' in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path...
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...
WordPress WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin <= 4.7.3 - Unauthenticated Sensitive Information Disclosure vulnerability
Unauthenticated Sensitive Information Disclosure vulnerability discovered by walid213 in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.7.3...
WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Muhamad Visat in WordPress Plugin Social Media & Share Icons versions = 3.0.1...
CVE-2026-89047
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
EUVD-2026-90543
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-89047
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) via URL in versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject a...
AlmaLinux 9.2 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752921642)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752921642 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...
AlmaLinux 9.2 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763138343)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763138343 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...
Malicious code in bnppf-flag-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install...
MAL-2026-16350 Malicious code in bnppf-flag-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install...
WordPress Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button plugin <= 3.5.9 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by uhcna - vietnam in WordPress Plugin Chaty versions = 3.5.9...
CVE-2026-86481
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons...
EUVD-2026-72507
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86491
JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...
CVE-2026-86491
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...
CVE-2026-86481
JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in which signed URL reuse allowed disclosure of restricted project icons . The underlying cause is the reuse of signed URLs, enabling an authenticated low-privilege user to access project icon resources that should re...