AmauriC vulnerabilities

Products

• tarteaucitron.js 8
• WPMobile.App 2
• WPMobile.App – Android and iOS App Builder 2
• amauric/tarteaucitron.js 1

Latest AmauriC CVEs

Newest publication first

1. CVE-2026-111714 tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

   Published 2026-10-16

   Low·CVSS 2.3 EPSS 0.22%

   tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...

2. CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

   Published 2026-10-16

   Medium·CVSS 5.1 EPSS 0.17%

   tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javasc...

3. CVE-2026-103421 WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment

   Published 2026-10-03

   Medium·CVSS 5.4 EPSS 0.22%

   The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and outpu...

4. CVE-2026-94541 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

   Published 2026-10-02

   Critical·CVSS 9.8 EPSS 0.49%

   The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauth...

5. CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

   Published 2026-07-17

   Medium·CVSS 4.3 EPSS 0.35%

   tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service...

6. CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

   Published 2026-01-13

   Medium·CVSS 4.4 EPSS 0.13%

   tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

7. CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

   Published 2025-07-03

   Medium·CVSS 4.2 EPSS 0.20%

   tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML ele...

8. CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs

   Published 2025-04-07

   Medium·CVSS 4.8 EPSS 0.36%

   tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Befor...

9. CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection

   Published 2025-04-07

   Medium·CVSS 6.6 EPSS 0.35%

   tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the si...

10. CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection

    Published 2025-04-07

    Medium·CVSS 6.6 EPSS 0.27%

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the...

11. CVE-2024-13888 WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

    Published 2025-02-20

    Medium·CVSS 6.1 EPSS 0.76%

    The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect use...

12. CVE-2024-12420 WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution

    Published 2024-12-13

    Medium·CVSS 6.5 EPSS 0.38%

    The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value befor...

13. CVE-2023-3620 Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

    Published 2023-07-11

    Medium·CVSS 5.4 EPSS 0.54%

    Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.