Malicious code in @bancolonbia/menu-filter-widget-web (npm)

Source: amazon-inspector 76511e7873dc4a76b8447f91807e48289877ee612cd0d94526206390bbda7f3e package.json declares scripts.postinstall: node./callback.js, which fires automatically on npm install. callback.js reads the installer's hostname and transmits it to a hardcoded Burp Collaborator domain...

Malicious code in @giftyhq/widget-components (npm)

Source: amazon-inspector 8ad3f12a6a12fbfa60e4a72747df6974f89906200568926b99a8c93c489b5e62 package.json declares "preinstall": "node index.js", which fires automatically on npm install. index.js collects host fingerprinting data — os.hostname, os.userInfo, process.platform, uid/gid, shell, cwd, an...

Malicious code in @cashback/how-it-works-widget (npm)

--- Credit: OpenSSF source...

Malicious code in process-status-widget (npm)

Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on install is to resolve its only declared dependency 'ltidisaf...

CVE-2026-15464

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-48511

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15464 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widgetsearch' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-64248

The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

cad-viewer-widget (>=1.3.5, <=1.4.0), jupyter-cadquery (>=3.1.0rc0, <=3.2.2) potentially affected by CVE-2026-73415 via jupyterlab (3.5.0rc0)

jupyterlab PYPI version 3.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget =1.3.5, =3.1.0rc0, =3.2.2 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

cad-viewer-widget (1.4.1), jupyter-cadquery (>=3.3.0, <=3.5.2) +1 more potentially affected by CVE-2026-73415 via jupyterlab (3.6.0rc1)

jupyterlab PYPI version 3.6.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget 1.4.1 - jupyter-cadquery =3.3.0, =3.5.2 - jupyter-cadquery-orion 0.0.1 Source cves: CVE-2026-73415 Source advisory:...

cad-viewer-widget (>=1.3.5, <=1.4.0), jupyter-cadquery (>=3.1.0rc0, <=3.2.2) potentially affected by CVE-2026-73626 via jupyterlab (3.5.0rc0)

jupyterlab PYPI version 3.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget =1.3.5, =3.1.0rc0, =3.2.2 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

cad-viewer-widget (1.4.1), jupyter-cadquery (>=3.3.0, <=3.5.2) +1 more potentially affected by CVE-2026-73626 via jupyterlab (3.6.0rc1)

jupyterlab PYPI version 3.6.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget 1.4.1 - jupyter-cadquery =3.3.0, =3.5.2 - jupyter-cadquery-orion 0.0.1 Source cves: CVE-2026-73626 Source advisory:...

CVE-2026-15787

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787

The CVE concerns The Ultimate Addons for Elementor (WordPress) up to version 2.9.1, where a Stored XSS exists in the Navigation Menu Widget via data-toggle-icon/data-close-icon attributes. The root cause is insufficient input sanitization and output escaping; wp_kses_post is applied on save for u...

EUVD-2026-47620

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15787: Improper Neutralization of Input During Web Page Generation

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-63331

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...