1164988 matches found
WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8...
WordPress Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Woo Labels versions = 2.48...
WordPress Download Manager plugin <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Download Manager versions = 3.3.66...
WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...
WordPress GenerateBlocks plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Or Benit in WordPress Plugin GenerateBlocks versions = 2.3.0...
WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...
WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-65841
CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...
EUVD-2026-51622
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...
GHSA-45QG-252V-3F7P Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...
Cross-site Scripting (XSS)
Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS via the clean-html. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting a element within an...
NPM: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
NPM: Jodit has cross-site scripting XSS via nested in SVG that bypasses clean-html sanitization vulnerability discovered by ? in WordPress Npm jodit versions 4.13.6...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
NPM: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier vulnerability discovered by ? in WordPress Npm jodit versions 4.12.28...
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Summary jodit's built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or...
GHSA-RXCW-MC6F-6HR3 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Summary jodit's built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value. When an application supplies attacker-influenced HTML to the editor's value-set or...