Alex vulnerabilities and threats

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

CVE-2026-66685 is a medium severity vulnerability in Alex Featured Video Plus versions up to 2.3.3 that allows unauthenticated sensitive data exposure. The flaw involves insertion of sensitive information into sent data, classified under CWE-201. There is no official patch or remediation guidance currently available from the vendor. No known exploits are reported in the wild.

Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.

Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through <= 1.8.5.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Include Fussball.de Widgets include-fussball-de-widgets allows Stored XSS.This issue affects Include Fussball.de Widgets: from n/a through <= 4.0.0.