CVE-2026-45806

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...

PHP-Textile has persistent XSS vulnerability in image link handling

Details Persistent XSS vulnerability in image link handling of PHP-Textile versions 4.1.2 and older, when running the parser in restricted mode. In restricted mode it is expected that the input would be sanitized, allowing user-input such as user comments to be parsed and handled safely by the...

GHSA-95M2-CHM4-MQ7M PHP-Textile has persistent XSS vulnerability in image link handling

Details Persistent XSS vulnerability in image link handling of PHP-Textile versions 4.1.2 and older, when running the parser in restricted mode. In restricted mode it is expected that the input would be sanitized, allowing user-input such as user comments to be parsed and handled safely by the...

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system allows a hacker to perform cross-site scripting attacks.

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system exists because measures are not taken to protect the structure of web pages when processing Image URLs. Exploiting this vulnerability allows a malicious actor to...