PT-2026-78309

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...

CVE-2026-15446: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2021-2530

Malware in sbrugna...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Malicious code in espn-lazysizes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60130f7b2b231061cc46a7cd1f6e01e416c6eaa83410e500788fd34809d817e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2853 Malicious code in espn-lazysizes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60130f7b2b231061cc46a7cd1f6e01e416c6eaa83410e500788fd34809d817e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-254 Malicious code in @espn-lazysizes/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54f13287006cc46085a40aefef14b533bc8c03a746796ea46c41ea4b6249eb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site scripting in lazysizes

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by CVE-2020-7642 via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: CVE-2020-7642 Source advisory: OSV:GHSA-HG2P-2CVQ-4PPV...

GHSA-HG2P-2CVQ-4PPV Cross-site scripting in lazysizes

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Cross-Site Scripting in lazysizes

Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by unknown CVE via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-W4VP-3MQ7-7V82...

GHSA-W4VP-3MQ7-7V82 Cross-Site Scripting in lazysizes

Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the...

PT-2020-21540

Name of the Vulnerable Software and Affected Versions lazysizes versions prior to 5.2.1-rc1 Description The issue affects the video-embed plugin of lazysizes, which fails to properly sanitize certain attributes, including data-vimeo, data-vimeoparams, data-youtube, and data-ytparams. This oversig...

Lazysizes Cross-Site Scripting Vulnerability

lazysizes is a lightweight inert loader. It is mainly used for delayed loading of content such as images, iframes and scripts. A security vulnerability exists in lazysizes 5.2.0 and earlier versions, which stems from the program's failure to clean up the following attributes: data-vimeo,...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Design/Logic Flaw

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

CVE-2020-7642 affects lazysizes up to version 5.2.0, where the video-embed plugin fails to sanitize attributes data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, enabling injection of malicious JavaScript. The vulnerability is tied to how untrusted payloads can be executed through the...