CVE-2025-30203: Improper Neutralization of Encoded URI Schemes in a Web Page

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting XSS via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force...

Malicious code in widgets-appointmentsmastercatalogtool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c565161397aa1043a43e73af3ab4716e2b6aad5ff7c1f4905131fe4575ed148 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2917 Malicious code in widgets-appointmentsmastercatalogtool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c565161397aa1043a43e73af3ab4716e2b6aad5ff7c1f4905131fe4575ed148 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21870

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name sname as the ALH copier and in that case the copier-data is NULL, no alhdata is attached, which could...

PT-2025-13023

Summary User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and in some cases are rendered in browser as valid html tags. Details Attributes passed to the widget such as label field containing , and similar tokens are n...

CVE-2025-30541 WordPress Info Boxes Shortcode And Widgets plugin <= 1.15 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery.This issue affects Info Boxes Shortcode and Widget: from n/a through = 1.15...

WordPress Info Boxes Shortcode And Widgets plugin <= 1.15 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Info Boxes Shortcode and Widget versions = 1.15...

WordPress HT Mega plugin <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin HT Mega versions = 2.8.3...

PT-2025-12013

Name of the Vulnerable Software and Affected Versions The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.8 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

CVE-2025-2108: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

MAL-2025-2448 Malicious code in @flutterfire/source-ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5007a2c3f744fc79ba88f20dcf5897470581ccbb3a076b83a10d43ad9c6f5e7 The OpenSSF Package Analysis project identified '@flutterfire/source-ui-widgets' @ 1.0.0 npm as malicious. It is considered malicious because: -...

CVE-2024-13703

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress plugin CRM and Lead Management by vcita 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...

CVE-2024-10326

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveoptions and resetwidgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

CVE-2024-10326

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveoptions and resetwidgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

WordPress RomethemeKit For Elementor plugin <= 1.5.3 - Missing Authorization in save_options and reset_widgets vulnerability

Missing Authorization in saveoptions and resetwidgets vulnerability discovered by WordFence in WordPress Plugin RTMKit versions = 1.5.3...

PT-2025-10413

Name of the Vulnerable Software and Affected Versions The 140+ Widgets | Xpro Addons For Elementor versions up to, and including, 1.4.6.7 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in several widgets. This allows...

PT-2025-10405

Name of the Vulnerable Software and Affected Versions RomethemeKit For Elementor plugin for WordPress versions up to, and including, 1.5.3 Description The issue allows authenticated attackers with Subscriber-level access and above to modify plugin settings or reset plugin widgets to their default...

CVE-2024-13649: Improper Neutralization of Input During Web Page Generation

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

GHSA-7G95-JMG9-H524 Jenkins cross-site request forgery (CSRF) vulnerability

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not require POST requests for the HTTP endpoint toggling collapsed/expanded status of sidepanel widgets e.g., Build Queue and Build Executor Status widgets, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability...