CWE-79 · Cross-site Scripting (page 11)
Page 11 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90795 | Medium | 4.3 | 2026-09-14 | A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a mani… |
CVE-2026-4103 | Medium | 6.4 | 2026-09-14 | Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralizatio… |
CVE-2026-82019 | Medium | 4.2 | 2026-09-14 | TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arb… |
CVE-2026-90957 | | 2026-09-14 | Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather… | |
CVE-2026-90931 | Medium | 5.4 | 2026-09-14 | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permi… |
CVE-2026-78318 | Medium | 6.1 | 2026-09-14 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionall… |
CVE-2026-90696 | Low | 3.5 | 2026-09-14 | A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/product… |
CVE-2026-90695 | Low | 3.5 | 2026-09-14 | A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendor… |
CVE-2026-90694 | Low | 3.5 | 2026-09-14 | A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the… |
CVE-2026-88853 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supp… | |
CVE-2026-88852 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11… | |
CVE-2026-85196 | | 2026-09-14 | Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0 - Articles A… | |
CVE-2026-85195 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link… | |
CVE-2026-85191 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites… | |
CVE-2026-85190 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable clas… | |
CVE-2026-85189 | | 2026-09-14 | Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination usi… | |
CVE-2026-82796 | Medium | 5.4 | 2026-09-14 | SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be execute… |
CVE-2026-82795 | Medium | 5.4 | 2026-09-14 | SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS… |
CVE-2026-82792 | Medium | 5.2 | 2026-09-14 | Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary… |
CVE-2026-82790 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is explo… |
CVE-2026-82788 | Medium | 6.1 | 2026-09-14 | Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web bro… |
CVE-2026-82781 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user… |
CVE-2026-82776 | Medium | 6.1 | 2026-09-14 | Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user'… |
CVE-2026-82773 | Medium | 6.1 | 2026-09-14 | Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary… |
CVE-2026-82771 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user'… |
CVE-2026-82769 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in us… |
CVE-2026-82767 | Medium | 5.2 | 2026-09-14 | Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. |
CVE-2026-82763 | Medium | 5.4 | 2026-09-14 | Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script ma… |
CVE-2024-23176 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-pag… |
CVE-2023-51769 | Medium | 6.1 | 2026-09-14 | Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. |
CVE-2023-28148 | High | 7.2 | 2026-09-14 | A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
CVE-2026-90615 | Medium | 4.3 | 2026-09-14 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Suc… |
CVE-2026-90604 | Low | 3.5 | 2026-09-14 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manip… |
CVE-2025-63842 | Medium | 5.4 | 2026-09-14 | A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary… |
CVE-2026-90602 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file I… |
CVE-2026-88793 | High | 8.8 | 2026-09-13 | The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on… |
CVE-2026-85129 | High | 8.8 | 2026-09-13 | The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data sub… |
CVE-2026-90583 | Medium | 4.3 | 2026-09-13 | A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the fi… |
CVE-2025-64059 | Low | 1.8 | 2026-09-13 | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to… |
CVE-2026-90571 | Medium | 4.3 | 2026-09-13 | A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/mai… |
CVE-2026-90570 | Low | 2.4 | 2026-09-13 | A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file lit… |
CVE-2026-90569 | Low | 2.4 | 2026-09-13 | A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemal… |
CVE-2026-90568 | Low | 3.5 | 2026-09-13 | A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resourc… |
CVE-2026-90567 | Low | 3.5 | 2026-09-13 | A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/s… |
CVE-2026-90564 | Low | 3.5 | 2026-09-13 | A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/c… |
CVE-2026-90563 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipula… |
CVE-2026-90529 | Low | 3.5 | 2026-09-13 | A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/… |
CVE-2026-90528 | Low | 3.5 | 2026-09-13 | A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/w… |
CVE-2026-90527 | Medium | 4.3 | 2026-09-13 | A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue o… |
CVE-2026-90772 | High | 7.6 | 2026-09-13 | Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem c… |
CVE-2026-90561 | High | 8.7 | 2026-09-13 | Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component t… |
CVE-2026-90502 | Low | 3.5 | 2026-09-13 | A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generat… |
CVE-2026-90497 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/view… |
CVE-2026-90489 | Low | 3.5 | 2026-09-13 | A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the ar… |
CVE-2026-10148 | Medium | 6.4 | 2026-09-12 | The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions u… |
CVE-2026-87888 | High | 8.0 | 2026-09-12 | The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the sub… |
CVE-2026-86790 | Medium | 6.8 | 2026-09-12 | The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, w… |
CVE-2026-83532 | Medium | 6.8 | 2026-09-12 | The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowin… |
CVE-2026-82847 | Medium | 6.8 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing… |
CVE-2026-81742 | High | 8.8 | 2026-09-12 | The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted… |
CVE-2026-81429 | High | 7.1 | 2026-09-12 | The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise t… |
CVE-2026-89268 | Medium | 5.4 | 2026-09-12 | QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attac… |
CVE-2026-90443 | Medium | 5.4 | 2026-09-11 | A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentic… |
CVE-2026-81918 | Medium | 4.8 | 2026-09-11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions… |
CVE-2026-81917 | Medium | 5.4 | 2026-09-11 | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with… |
CVE-2026-54165 | | 2026-09-11 | Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XS… | |
CVE-2026-81911 | Medium | 5.4 | 2026-09-11 | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request onl… |
CVE-2026-79035 | Medium | 6.1 | 2026-09-11 | A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary… |
CVE-2026-77490 | Medium | 6.1 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-62138 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. |
CVE-2026-62111 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
CVE-2026-62110 | Medium | 6.5 | 2026-09-11 | Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. |
CVE-2026-82535 | Medium | 6.1 | 2026-09-11 | Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payl… |
CVE-2026-7298 | Medium | 6.1 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerc… |
CVE-2026-68528 | | 2026-09-11 | Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An atta… | |
CVE-2026-89256 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names… |
CVE-2026-89255 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HT… |
CVE-2026-89254 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field… |
CVE-2026-89253 | High | 8.7 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile fie… |
CVE-2026-89249 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied… |
CVE-2026-89244 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php… |
CVE-2026-89243 | High | 8.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fa… |
CVE-2026-89241 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that cop… |
CVE-2026-89240 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword… |
CVE-2026-89239 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function… |
CVE-2026-17037 | High | 7.2 | 2026-09-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter i… |
CVE-2026-6642 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up t… |
CVE-2026-6641 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3… |
CVE-2026-6640 | Medium | 6.4 | 2026-09-11 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, an… |
CVE-2026-86780 | Medium | 6.8 | 2026-09-11 | The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow u… |
CVE-2026-85678 | Medium | 6.8 | 2026-09-11 | The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end… |
CVE-2026-85677 | High | 8.8 | 2026-09-11 | The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, app… |
CVE-2026-83546 | Medium | 6.8 | 2026-09-11 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contribu… |
CVE-2026-83545 | Medium | 6.8 | 2026-09-11 | The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with co… |
CVE-2026-14565 | Medium | 5.4 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to… |
CVE-2025-15695 | Low | 3.5 | 2026-09-11 | The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup… |
CVE-2026-84960 | Medium | 6.1 | 2026-09-11 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including… |
CVE-2026-81825 | High | 7.2 | 2026-09-11 | The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, an… |
CVE-2026-81754 | High | 7.2 | 2026-09-11 | The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Age… |
CVE-2026-7438 | Medium | 6.4 | 2026-09-11 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_i… |