Threats affecting pkg:github/nextlevelbuilder/ui-ux-pro-max-skill

CVE-2026-7596 is a medium severity cross-site scripting (XSS) vulnerability found in nextlevelbuilder's ui-ux-pro-max-skill component up to version 2.5.0. The issue exists in the data.get function within the Slide Generator component's generate-slide.py script. This vulnerability can be exploited remotely and requires user interaction. The vulnerability has been publicly disclosed, and although the project was notified early via a pull request, no official fix or remediation has been released yet.

A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py of the component Tailwind Config Generator. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.