188 matches found
CVE-2026-115869
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
EUVD-2026-114233
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869 Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
CVE-2026-115869
The Themify Builder plugin for WordPress (versions up to and including 7.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'variations' repeater field of Custom Font (tb_cf) posts. The root cause is insufficient input sanitization in Themify_Metabox::_save_meta(), which fails to ap...
CVE-2026-118540
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...
PT-2026-133702
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tb cf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify...
CVE-2026-115869: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater…
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font tbcf posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta:...
DRUPAL-CONTRIB-2026-259
This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor ca...
PT-2026-130570
This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only...
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only...
Variations Component DoS
The vulnerability in the Variations component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...
SUSE CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-105541
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-113205
A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from a use-after-free memory management error in the Variations component...
DEBIAN-CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-113205
Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...
CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-113205
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...