PHPJabbers Callback Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. id: CVE-2023-40755 info: name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site Scripting...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0. id: CVE-2023-40752 info: name: PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site...

Advanced Text Widget < 2.0.2 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. id: CVE-2011-4618 info: name: Advanced Text Widget 2.0.2 - Cross-Site Scripting author:...

Wordpress Polls Widget < 1.5.3 - SQL Injection

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks id: CVE-2021-24442 inf...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Author Remote Code Execution RCE in Widget Options = 4.2.5 versions...

CVE-2026-119365: bPlugins Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widge...

firefox: thunderbird: Use-after-free in the Widget component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...

firefox: thunderbird: Use-after-free in the Widget component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...

firefox: thunderbird: Use-after-free in the Widget component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component...

snowpick

snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data exposure. ServiceNow exposes data through two common public surfaces: Service Portal widgets and the Table REST API. When access controls on either surface are...

CVE-2026-30862

CVE-2026-30862 PoC - Privilege Escalation in Appsmith Proof-of-Concept for Privilege Escalation in Appsmith via Stored XSS Disclosure: Originally reported by me via GHSA-5hw4-whxv-6794 ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID| CVE-2026-30862...

firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...

firefox: thunderbird: Use-after-free in the Widget component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component...

firefox: thunderbird: Use-after-free in the Widget component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget component...

firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...