GHSA-3X7P-V8HJ-XH5M FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

Summary WidgetVariante::renderVariantList Core/Lib/Widget/WidgetVariante.php:298-330 and WidgetSubcuenta::renderSubaccountList Core/Lib/Widget/WidgetSubcuenta.php:290-321 build the row for each modal hit by concatenating the user-controlled referencia / codsubcuenta field directly into a...

Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

MAL-2026-10581 Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

CVE-2025-15665 BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2025-15665

The Ultimate Before After Image Slider & Gallery WordPress plugin, versions before 4.7.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end; sp...

EUVD-2025-210458

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2025-15665 BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

CVE-2026-11390

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-11390

Vulnerability summary (CVE-2026-11390): News Kit Addons For Elementor (WordPress) versions up to 1.4.6 are affected by a stored cross-site scripting (XSS) flaw in the Site Logo Title and Single Author Box widgets. The root cause is insufficient input sanitization and output escaping. Exploitation...

CVE-2026-11390 News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-11390

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-58941

Summary WidgetVariante::renderVariantList Core/Lib/Widget/WidgetVariante.php:298-330 and WidgetSubcuenta::renderSubaccountList Core/Lib/Widget/WidgetSubcuenta.php:290-321 build the row for each modal hit by concatenating the user-controlled referencia / codsubcuenta field directly into a...

PT-2026-57950

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

cad-viewer-widget (>=1.3.5, <=1.4.0), jupyter-cadquery (>=3.1.0rc0, <=3.2.2) potentially affected by CVE-2026-42557 via jupyterlab (3.5.0rc0)

jupyterlab PYPI version 3.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget =1.3.5, =3.1.0rc0, =3.2.2 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...

cad-viewer-widget (1.4.1), jupyter-cadquery (>=3.3.0, <=3.5.2) +1 more potentially affected by CVE-2026-42557 via jupyterlab (3.6.0rc1)

jupyterlab PYPI version 3.6.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget 1.4.1 - jupyter-cadquery =3.3.0, =3.5.2 - jupyter-cadquery-orion 0.0.1 Source cves: CVE-2026-42557 Source advisory:...

cad-viewer-widget (>=1.3.5, <=1.4.0), jupyter-cadquery (>=3.1.0rc0, <=3.2.2) potentially affected by CVE-2026-40171 via jupyterlab (3.5.0rc0)

jupyterlab PYPI version 3.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget =1.3.5, =3.1.0rc0, =3.2.2 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

cad-viewer-widget (1.4.1), jupyter-cadquery (>=3.3.0, <=3.5.2) +1 more potentially affected by CVE-2026-40171 via jupyterlab (3.6.0rc1)

jupyterlab PYPI version 3.6.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cad-viewer-widget 1.4.1 - jupyter-cadquery =3.3.0, =3.5.2 - jupyter-cadquery-orion 0.0.1 Source cves: CVE-2026-40171 Source advisory:...

CVE-2026-11591

CVE-2026-11591 affects the WordPress plugin Widgets for Google Reviews up to version 13.3. It is a Stored Cross‑Site Scripting (XSS) vulnerability triggered via admin settings, caused by insufficient input sanitization and output escaping in the parameters fomo-title and fomo-text . Exploitation ...

CVE-2026-11591 Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

PT-2026-57408

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...