EUVD-2026-109226

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manag...

CVE-2026-112207 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

PT-2026-122497

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manag...

Linux Distros Unpatched Vulnerability : CVE-2026-115754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending...

CVE-2026-115897

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

Cross-site Scripting (XSS)

Overview org.webjars.npm:serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function bo...

@adeweb-be/volto-leaflet-block (0.2.0), @appsemble/cli (>=0.40.5, <=0.40.6) +54 more potentially affected by CVE-2026-115897 via serialize-javascript (>=7.0.0, <=7.1.2)

serialize-javascript NPM version =7.0.0, =0.40.5, =0.40.5, =0.40.5, =10.0.6, =0.0.0-FEC-1017-shell-splitter-region-20260615151229, =0.0.0-canary-20260416134143, =1.0.5, =0.5.3, =0.3.6, =0.4.6, =0.3.7, =0.4.6, =0.21.0, =0.0.29, =1.11.0-canary.8 and more Source cves: CVE-2026-115897 Source advisory...

GHSA-M5MM-P8H7-M29V Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Impact serialize-javascript escapes its output so it is safe to embed inside a element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare . A body ending exactly at followed by markup: js const serialize = require'serialize-javascript'; function f f.toStrin...

@adeweb-be/volto-leaflet-block (0.2.0), @appsemble/cli (>=0.40.5, <=0.40.6) +54 more potentially affected by CVE-2026-115897 via serialize-javascript (>=7.0.0, <=7.1.2)

serialize-javascript NPM version =7.0.0, =0.40.5, =0.40.5, =0.40.5, =10.0.6, =0.0.0-FEC-1017-shell-splitter-region-20260615151229, =0.0.0-canary-20260416134143, =1.0.5, =0.5.3, =0.3.6, =0.4.6, =0.3.7, =0.4.6, =0.21.0, =0.0.29, =1.11.0-canary.8 and more Source cves: CVE-2026-115897 Source advisory...

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Impact serialize-javascript escapes its output so it is safe to embed inside a element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare . A body ending exactly at followed by markup: js const serialize = require'serialize-javascript'; function f f.toStrin...

@adeweb-be/volto-leaflet-block (0.2.0), @appsemble/cli (>=0.40.5, <=0.40.6) +54 more potentially affected by CVE-2026-115897 via serialize-javascript (>=7.0.0, <=7.1.2)

serialize-javascript NPM version =7.0.0, =0.40.5, =0.40.5, =0.40.5, =10.0.6, =0.0.0-FEC-1017-shell-splitter-region-20260615151229, =0.0.0-canary-20260416134143, =1.0.5, =0.5.3, =0.3.6, =0.4.6, =0.3.7, =0.4.6, =0.21.0, =0.0.29, =1.11.0-canary.8 and more Source cves: CVE-2026-115897 Source advisory...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function body in isolation...

npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

npm: Serialize JavaScript: Cross-site scripting XSS via unescaped /script at the end of a serialized function body vulnerability discovered by ? in WordPress npm serialize-javascript versions 7.1.3...

CVE-2026-115897

A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct Cross-Site Scripting XSS by supplying crafted function source text that bypasses escaping logic. When the resulting serialized data is rendered inside an HTML script block on a web page, the unneutralized...

CVE-2026-115897

The Serialize JavaScript library is vulnerable to Cross-site Scripting (XSS) in versions prior to 7.1.3 . The root cause is that the function-source escaping logic fails to neutralize a bare "&gt; prefix when attacker-influenced source text ends exactly at that prefix. Because function bodies are...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CVE-2026-115897

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

@adeweb-be/volto-leaflet-block (0.2.0), @appsemble/cli (>=0.40.5, <=0.40.6) +54 more potentially affected by CVE-2026-115897 via serialize-javascript (>=7.0.0, <=7.1.2)

serialize-javascript NPM version =7.0.0, =0.40.5, =0.40.5, =0.40.5, =10.0.6, =0.0.0-FEC-1017-shell-splitter-region-20260615151229, =0.0.0-canary-20260416134143, =1.0.5, =0.5.3, =0.3.6, =0.4.6, =0.3.7, =0.4.6, =0.21.0, =0.0.29, =1.11.0-canary.8 and more Source cves: CVE-2026-115897 Source advisory...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...