WordPress plugin Spotify Embed Creator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

PT-2025-37282

Name of the Vulnerable Software and Affected Versions: Spotify Embed Creator plugin for WordPress versions up to and including 1.0.5 Description: The Spotify Embed Creator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s spotify shortcode. Insufficient input...

WordPress Spotify Embed Creator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Spotify Embed Creator versions = 1.0.5...

Malicious code in spotify-heroic-datasource (npm)

The package spotify-heroic-datasource was found to contain malicious code...

Malicious code in spotify-apollo-oss-site (npm)

The package spotify-apollo-oss-site was found to contain malicious code...

Malicious code in spotify-talos (npm)

The package spotify-talos was found to contain malicious code...

MAL-2025-33799 Malicious code in spotify-talos (npm)

The package spotify-talos was found to contain malicious code...

MAL-2025-33798 Malicious code in spotify-heroic-datasource (npm)

The package spotify-heroic-datasource was found to contain malicious code...

MAL-2025-33797 Malicious code in spotify-apollo-oss-site (npm)

The package spotify-apollo-oss-site was found to contain malicious code...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2025-8916 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2025-8916 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-11789704...

MAL-2025-6857 Malicious code in spotify-test (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in spotify-test (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-5199

The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-42011

The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat...

CVE-2024-11192

The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotifyplaybutton shortcode in all versions up to, and including, 2.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-28193

yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify A...

CVE-2023-41131

Cross-Site Request Forgery CSRF vulnerability in Jonk @ Follow me Darling Sptify Play Button for WordPress plugin = 2.10 versions...

CVE-2023-44145

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in jesweb.Dev Anchor Episodes Index Spotify for Podcasters plugin = 2.1.7 versions...

CVE-2023-1840

The Sptify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-23608

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an...