https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-11611.htmlhttps://patchthecve.com/cve/CVE-2020-11611.htmlWed, 17 Jun 2026 02:50:28 +0000MEDIUM 6.1: An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messahttps://patchthecve.com/cve/CVE-2020-11610.htmlhttps://patchthecve.com/cve/CVE-2020-11610.htmlWed, 17 Jun 2026 02:50:28 +0000HIGH 8.8: An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" https://patchthecve.com/cve/CVE-2015-9545.htmlhttps://patchthecve.com/cve/CVE-2015-9545.htmlWed, 17 Jun 2026 00:36:44 +0000HIGH 7.1: An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrhttps://patchthecve.com/cve/CVE-2015-9544.htmlhttps://patchthecve.com/cve/CVE-2015-9544.htmlWed, 17 Jun 2026 00:36:44 +0000HIGH 7.1: An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidential