CVE-2025-66400

A flaw was found in mdast-util-to-hast. This vulnerability allows rendered user supplied markdown Markdown code elements to appear like the rest of the page via character references. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Re...

CVE-2025-9436

CVE-2025-9436 affects the WordPress plugin “Widgets for Google Reviews” (trustindex shortcode). All versions up to 13.2.1 are vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated acces...

EUVD-2025-202662

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's trustindex shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-66400

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This...

CVE-2025-66400 mdast-util-to-hast unsanitized class attribute

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This...

PT-2025-48573

Name of the Vulnerable Software and Affected Versions mdast-util-to-hast versions 13.0.0 through 13.2.0 Description mdast-util-to-hast, a utility used to transform markdown to HTML, has an issue where multiple, unprefixed classnames could be added to markdown source using character references. Th...

Jetpack < 13.2.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks When the "Let visitors subscribe...

Apple macOS Ventura 资源管理错误漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A resource management error vulnerability exists in Apple macOS Ventura versions prior to 13.2.1, iOS versions prior to 16.3.1, and iPadOS versions prior to 16.3.1, which stems from improper input validation,...