PT-2025-33986 · WordPress · Radiustheme Widget For Google Reviews

Name of the Vulnerable Software and Affected Versions: RadiusTheme Widget for Google Reviews versions through 1.0.15 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File...

WordPress plugin Contact Info Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2025-33959 · Unknown · Riotweb Contact Info Widget

Name of the Vulnerable Software and Affected Versions: riotweb Contact Info Widget versions through 2.6.2 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: Update to a version later than 2.6.2...

PT-2025-33717 · WordPress · Nexter Blocks

Name of the Vulnerable Software and Affected Versions: Nexter Blocks versions prior to 4.5.5 Description: The Nexter Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS via multiple widgets. Insufficient input sanitization and output escaping on user-supplied attributes...

Linux Distros Unpatched Vulnerability : CVE-2021-39202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets edito...

WordPress Contact Info Widget plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Contact Info Widget versions = 2.6.2...

CVE-2025-8867 Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories,...

PT-2025-33431 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Graphina - Elementor Charts and Graphs plugin for WordPress versions 3.1.3 and below Description: The Graphina - Elementor Charts and Graphs plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple chart widget...

CVE-2025-43734

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...

Malicious code in merchant-newsletter-widget (npm)

The package merchant-newsletter-widget was found to contain malicious code...

Malicious code in appointment-widget (npm)

The package appointment-widget was found to contain malicious code...

Malicious code in thingsboard-advanced-attribute-widget (npm)

The package thingsboard-advanced-attribute-widget was found to contain malicious code...

Malicious code in op-payment-widget-v3 (npm)

The package op-payment-widget-v3 was found to contain malicious code...

Malicious code in @avocado-team/app-center-app-widget (npm)

The package @avocado-team/app-center-app-widget was found to contain malicious code...

MAL-2025-36813 Malicious code in thingsboard-advanced-attribute-widget (npm)

The package thingsboard-advanced-attribute-widget was found to contain malicious code...

MAL-2025-17841 Malicious code in customer-appointment-detail-widget (npm)

The package customer-appointment-detail-widget was found to contain malicious code...

MAL-2025-16449 Malicious code in calendar-widget (npm)

The package calendar-widget was found to contain malicious code...

MAL-2025-19103 Malicious code in ebay-items-react-widget-server (npm)

The package ebay-items-react-widget-server was found to contain malicious code...

MAL-2025-13992 Malicious code in ace-one-widget-self-hosting (npm)

The package ace-one-widget-self-hosting was found to contain malicious code...

Malicious code in alloy-widget-npm (npm)

The package alloy-widget-npm was found to contain malicious code...