233 matches found
wix-kickstartx-challenge-writeup
Wix KickstartX Challenge 2026 — Full Writeup Result: 200/200 100% — Token: WKX-9245FA70-200 Date: March 24, 2026 1. Discovery & Reconnaissance The Challenge Announcement A LinkedIn post announced a special challenge for Wix KickstartX — a junior developer program. The rules: 30 minutes, one...
MAL-2026-17711 Malicious code in wix-reg-poc-bypass (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...
Malicious code in wix-reg-poc-bypass (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...
Malicious code in css-flow-render-shim (npm)
Source: amazon-inspector f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd The package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys...
Malicious Package
Overview wix-ssr-thunderbolt-grid-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
MAL-2026-17655 Malicious code in css-flow-render-shim (npm)
[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...
Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1 The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstra...
MAL-2026-17664 Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1 The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstra...
This fake Windows support website delivers password-stealing malware
A fake Microsoft support website is tricking people into downloading what looks like a normal Windows update. Instead, it installs malware designed to steal passwords, payment details, and account access. Because the file looks legitimate and avoids detection, it can slip past both users and...
CVE-2026-2276
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
CVE-2026-2276
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
CVE-2026-2276
CVE-2026-2276 describes a reflected XSS in Wix’s web app where uploading SVGs to the endpoint https://manage.wix.com/account/account-settings permits embedded JavaScript execution after storage. Authenticated users could upload crafted SVG content; when others view the image, script executes in t...
CVE-2026-2276 Reflected Cross-Site Scripting in the Wix web application
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
CVE-2026-2276
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
CVE-2026-2276 Reflected Cross-Site Scripting in the Wix web application
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
Wix cross-site scripting vulnerabilities
Wix is a website building platform provided by the Israeli company Wix. Wix has a cross-site scripting vulnerability, which stems from the improper cleanup of content by the endpoint responsible for uploading SVG images. This vulnerability may lead to reflective cross-site scripting attacks...
PT-2026-7835
Name of the Vulnerable Software and Affected Versions Wix affected versions not specified Description A Reflected Cross-Site Scripting XSS issue exists in the Wix web application. The vulnerability is located in the SVG image upload functionality at the...
CVE-2026-2276: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting XSS vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsible for uploading SVG images, does not properly sanitize the content. An authenticated attacker could upload an SVG file containing embedded...
CVE-2019-16511
An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file even with a ../ sequence is...
📄 WIX.com Cross Site Scripting
WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are posting this to encourage them to address it and to let their users know that they could be affected by this vulnerability. Titles: WIX.com /...