CWE-79 · Cross-site Scripting (page 10)
Page 10 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86311 | Medium | 6.4 | 2026-09-17 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in al… |
CVE-2026-92590 | Medium | 5.4 | 2026-09-16 | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescapin… |
CVE-2026-92584 | Medium | 6.1 | 2026-09-16 | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoA… |
CVE-2026-61597 | | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in comp… | |
CVE-2026-92814 | Medium | 4.2 | 2026-09-16 | changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malici… |
CVE-2026-20309 | Medium | 6.1 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a refl… |
CVE-2026-92418 | Low | 3.5 | 2026-09-16 | A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/… |
CVE-2026-88593 | Medium | 6.1 | 2026-09-16 | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent re… |
CVE-2026-84397 | Medium | 5.4 | 2026-09-16 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-85386 | Medium | 6.1 | 2026-09-16 | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated b… |
CVE-2026-85385 | Critical | 9.6 | 2026-09-16 | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management… |
CVE-2026-92385 | Low | 2.4 | 2026-09-16 | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_categor… |
CVE-2026-92381 | Low | 3.5 | 2026-09-16 | A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.ph… |
CVE-2026-88976 | Medium | 6.1 | 2026-09-16 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deseri… |
CVE-2026-63671 | High | 8.1 | 2026-09-16 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowD… |
CVE-2026-92140 | Medium | 6.8 | 2026-09-16 | Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cro… |
CVE-2026-92136 | High | 8.0 | 2026-09-16 | Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross… |
CVE-2026-92135 | High | 8.0 | 2026-09-16 | Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API… |
CVE-2026-92134 | High | 8.0 | 2026-09-16 | Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST… |
CVE-2026-73169 | | 2026-09-16 | Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus tran… | |
CVE-2026-78252 | High | 8.2 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain c… |
CVE-2026-19619 | Medium | 4.7 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-86784 | Medium | 6.8 | 2026-09-16 | The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart edit… |
CVE-2026-86444 | High | 7.1 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthentic… |
CVE-2026-84829 | High | 8.8 | 2026-09-16 | The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthent… |
CVE-2026-84088 | Medium | 6.8 | 2026-09-16 | The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a… |
CVE-2026-76558 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of o… |
CVE-2026-5920 | Medium | 6.4 | 2026-09-16 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode… |
CVE-2026-18555 | Medium | 6.1 | 2026-09-16 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn… |
CVE-2026-18595 | High | 7.2 | 2026-09-16 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, an… |
CVE-2026-11996 | Medium | 6.4 | 2026-09-16 | The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including… |
CVE-2026-92214 | Low | 3.5 | 2026-09-16 | A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/… |
CVE-2026-15639 | | 2026-09-16 | An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. | |
CVE-2026-92257 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the cal… |
CVE-2026-76873 | Medium | 5.2 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components han… |
CVE-2026-76872 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_stati… |
CVE-2026-76867 | Medium | 5.4 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including rout… |
CVE-2026-76864 | Medium | 4.8 | 2026-09-15 | NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and… |
CVE-2026-76858 | Medium | 4.8 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data… |
CVE-2026-92234 | Medium | 5.4 | 2026-09-15 | QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page… |
CVE-2026-81927 | Medium | 5.4 | 2026-09-15 | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject fi… |
CVE-2026-81926 | Medium | 6.1 | 2026-09-15 | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The pane… |
CVE-2026-88743 | Medium | 6.1 | 2026-09-15 | Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. |
CVE-2026-88742 | Medium | 5.4 | 2026-09-15 | Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. |
CVE-2026-81925 | Medium | 6.1 | 2026-09-15 | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scr… |
CVE-2026-76704 | Medium | 5.5 | 2026-09-15 | A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary… |
CVE-2026-51133 | Medium | 6.1 | 2026-09-15 | Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size para… |
CVE-2026-68534 | | 2026-09-15 | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenti… | |
CVE-2026-81899 | | 2026-09-15 | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stor… | |
CVE-2026-81898 | | 2026-09-15 | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association view… | |
CVE-2026-39040 | Medium | 5.4 | 2026-09-15 | BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx. |
CVE-2026-39039 | Medium | 5.3 | 2026-09-15 | In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage… |
CVE-2026-39038 | Medium | 6.1 | 2026-09-15 | BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx. |
CVE-2026-18113 | | 2026-09-15 | In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could… | |
CVE-2026-12750 | Medium | 6.4 | 2026-09-15 | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScri… |
CVE-2026-12749 | Medium | 6.4 | 2026-09-15 | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScri… |
CVE-2026-91854 | Medium | 4.3 | 2026-09-15 | A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of th… |
CVE-2026-81897 | Medium | 5.4 | 2026-09-15 | In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an… |
CVE-2026-81896 | Medium | 5.4 | 2026-09-15 | Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard… |
CVE-2026-81894 | Medium | 5.4 | 2026-09-15 | Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled M… |
CVE-2026-55692 | High | 7.5 | 2026-09-15 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2026-55691 | High | 8.6 | 2026-09-15 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2026-55690 | High | 7.5 | 2026-09-15 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2026-91944 | Medium | 6.1 | 2026-09-15 | crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns t… |
CVE-2026-91942 | Medium | 5.4 | 2026-09-15 | crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.inner… |
CVE-2026-87793 | | 2026-09-15 | The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated… | |
CVE-2026-55630 | Unrated | | 2026-09-15 | Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered sto… |
CVE-2026-44282 | Medium | 4.8 | 2026-09-15 | Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management right… |
CVE-2026-90650 | High | 7.2 | 2026-09-15 | The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, a… |
CVE-2026-88618 | Medium | 6.5 | 2026-09-15 | 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arb… |
CVE-2026-55650 | Medium | 4.4 | 2026-09-15 | Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/comp… |
CVE-2026-15609 | Medium | 6.4 | 2026-09-15 | The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in al… |
CVE-2026-91922 | Medium | 6.1 | 2026-09-15 | Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to proper… |
CVE-2026-62280 | Medium | 6.1 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects r… |
CVE-2026-44793 | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration incons… | |
CVE-2026-44203 | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficientl… | |
CVE-2026-18063 | Medium | 6.4 | 2026-09-15 | The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2… |
CVE-2026-15402 | Medium | 6.4 | 2026-09-15 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_she… |
CVE-2026-90850 | Low | 2.4 | 2026-09-15 | A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-student… |
CVE-2026-90848 | Medium | 4.3 | 2026-09-15 | A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a ma… |
CVE-2026-90845 | Low | 3.5 | 2026-09-15 | A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Execut… |
CVE-2026-85657 | Medium | 5.4 | 2026-09-15 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-85575 | Medium | 6.4 | 2026-09-15 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable… |
CVE-2026-90835 | Low | 3.5 | 2026-09-14 | A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Pag… |
CVE-2026-81900 | Medium | 6.1 | 2026-09-14 | Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escapi… |
CVE-2026-18116 | Medium | 6.1 | 2026-09-14 | Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion noti… |
CVE-2026-91146 | Medium | 6.1 | 2026-09-14 | Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascr… |
CVE-2026-18117 | Medium | 5.4 | 2026-09-14 | Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim()… |
CVE-2026-86898 | Medium | 5.4 | 2026-09-14 | A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening… |
CVE-2026-81903 | Medium | 5.4 | 2026-09-14 | Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known contai… |
CVE-2026-7884 | Medium | 5.4 | 2026-09-14 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include mali… |
CVE-2026-78415 | Medium | 5.4 | 2026-09-14 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutr… |
CVE-2026-13276 | Medium | 6.1 | 2026-09-14 | IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity… |
CVE-2026-18119 | Critical | 9.0 | 2026-09-14 | Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cr… |
CVE-2026-16186 | Medium | 5.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability. |
CVE-2026-91021 | Medium | 5.4 | 2026-09-14 | Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper… |
CVE-2026-55847 | Medium | 6.1 | 2026-09-14 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/jav… |
CVE-2026-54181 | Medium | 5.4 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54087 | High | 7.6 | 2026-09-14 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable upload… |
CVE-2026-90943 | High | 8.7 | 2026-09-14 | parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users t… |