21546 matches found
Malicious Package
Overview postcss-theme-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Theme Nokri versions = 1.6.6...
CVE-2026-72574
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...
WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...
WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...
WordPress PIMP - Creative MultiPurpose theme <= 1.7 - Cross Site Scripting (XSS) vulnerability
WordPress PIMP - Creative MultiPurpose theme = 1.7 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme PIMP - Creative MultiPurpose versions = 1.7...
WordPress Wigi theme <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Wigi versions = 2.0.1...
CVE-2026-72574
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...
CVE-2026-72574
The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...
WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Account Takeover vulnerability discovered by Denver Jackson in WordPress Theme Cartify versions = 1.3.0.1...
PT-2026-69931
Name of the Vulnerable Software and Affected Versions Typemill CMS versions 2.x Description A persistent cross-site scripting issue exists in the Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by providing unsanitized href value...
Malicious code in postcss-theme-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...
MAL-2026-13518 Malicious code in postcss-theme-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...
WordPress Blogfolio theme <=3.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Blogfolio versions =3.0.5...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
EUVD-2026-53893
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-66681
Theme My Login WordPress plugin
