Thinfinity Iframe Injection

A vulnerability exists in Thinfinity VirtualUI in a function located in /lab.html reachable which by default could allow IFRAME injection via the "vpath" parameter. id: CVE-2021-45092 info: name: Thinfinity Iframe Injection author: danielmofer severity: critical description: A vulnerability exist...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409

WPForms Pro for WordPress (all versions ≤ 2.0.0.2 ) is vulnerable to unauthenticated Stored XSS via Single Line Text and Paragraph Text Field values. The root cause is the plugin's own wp_kses_allowed_html filter, which widens the 'post' allowlist to permit iframe elements with a data-src attribu...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-79293

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-79374

Name of the Vulnerable Software and Affected Versions PassPortal browser extension versions prior to 3.49.6 Description An unvalidated postMessage vulnerability in the PassPortal browser extension allows for authentication abuse. This flaw enables any website or iframe viewed by a user to obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-64728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS...

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

CVE-2026-65904

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

BIT-DISCOURSE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0...

BIT-DISCOURSE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms

A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...

CVE-2026-72720

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

EUVD-2026-55656

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720

CVE-2026-72720 affects the Discourse open‑source forum platform. The issue is an HTML injection vulnerability in PrettyText.format_for_email where cooked attribute values are reparsed as markup, enabling decoded attribute text from crafted Vimeo iframe sources, secure-upload URLs or dimensions, a...