CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

Malicious code in package-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ee7402d49aeecdf40eecddd54c43432e034a74e4cbec83447f396485971eff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5176 Malicious code in package-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ee7402d49aeecdf40eecddd54c43432e034a74e4cbec83447f396485971eff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...