CWE-79 · Cross-site Scripting (page 11)
Page 11 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11591 | Medium | 4.4 | 2026-07-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3… |
CVE-2026-13378 | High | 7.2 | 2026-07-11 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up… |
CVE-2026-9738 | Medium | 4.4 | 2026-07-11 | The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versio… |
CVE-2026-15097 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and includ… |
CVE-2026-15096 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including… |
CVE-2026-12141 | Medium | 4.9 | 2026-07-11 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_to… |
CVE-2025-13968 | Medium | 6.4 | 2026-07-11 | The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-li… |
CVE-2026-5743 | Medium | 6.4 | 2026-07-11 | The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including… |
CVE-2026-3367 | Medium | 4.4 | 2026-07-11 | The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and i… |
CVE-2026-13114 | High | 7.2 | 2026-07-11 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biograp… |
CVE-2026-11913 | Critical | 9.8 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. |
CVE-2026-58591 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i… |
CVE-2026-58588 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-58587 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-55808 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-15085 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue… |
CVE-2026-15084 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS… |
CVE-2026-15082 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting… |
CVE-2026-13234 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2026-13231 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) all… |
CVE-2026-11908 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagif… |
CVE-2026-10770 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This… |
CVE-2026-10769 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affect… |
CVE-2026-57214 | Medium | 5.4 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML… |
CVE-2026-57213 | Medium | 4.8 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag f… |
CVE-2026-55879 | Critical | 9.3 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from… |
CVE-2026-55665 | | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker… | |
CVE-2026-55659 | High | 7.7 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into t… |
CVE-2026-55481 | Medium | 4.8 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS styl… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-54714 | Medium | 6.1 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and action… |
CVE-2026-55464 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, a… |
CVE-2025-30008 | Medium | 4.6 | 2026-07-10 | HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a… |
CVE-2026-56667 | High | 7.3 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.def… |
CVE-2026-55890 | Medium | 4.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leave… |
CVE-2026-3251 | Medium | 6.4 | 2026-07-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webremium Istanbul Web Design Mezunum Satiyorum allows St… |
CVE-2026-8595 | Medium | 6.8 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of an… |
CVE-2026-61492 | Low | 3.5 | 2026-07-10 | In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible |
CVE-2026-61456 | Medium | 4.6 | 2026-07-10 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUpload… |
CVE-2026-59795 | High | 8.1 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible |
CVE-2026-59794 | High | 7.3 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data |
CVE-2026-56354 | Medium | 4.1 | 2026-07-10 | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due… |
CVE-2026-29519 | High | 8.2 | 2026-07-10 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing t… |
CVE-2026-41877 | | 2026-07-10 | R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being up… | |
CVE-2026-13710 | Medium | 6.4 | 2026-07-10 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-13247 | Medium | 6.4 | 2026-07-10 | The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'l… |
CVE-2026-9838 | Medium | 6.1 | 2026-07-10 | The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12… |
CVE-2026-3907 | Medium | 6.4 | 2026-07-10 | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This… |
CVE-2026-12924 | Medium | 6.4 | 2026-07-10 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn… |
CVE-2026-12108 | Medium | 4.4 | 2026-07-10 | The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.0 du… |
CVE-2026-15301 | Medium | 6.4 | 2026-07-10 | The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and includi… |
CVE-2026-15299 | Medium | 6.4 | 2026-07-10 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of… |
CVE-2026-15298 | High | 7.2 | 2026-07-10 | The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient i… |
CVE-2026-15297 | Medium | 6.1 | 2026-07-10 | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting vi… |
CVE-2026-15296 | Medium | 6.4 | 2026-07-10 | The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' short… |
CVE-2026-15292 | Medium | 6.4 | 2026-07-10 | The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background' parameter in the 'sudoku-sc' shortcode in all versi… |
CVE-2026-15285 | Medium | 6.4 | 2026-07-10 | The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_a… |
CVE-2026-15284 | Medium | 6.4 | 2026-07-10 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and includi… |
CVE-2026-15283 | Medium | 4.4 | 2026-07-10 | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33… |
CVE-2026-15321 | Low | 2.4 | 2026-07-10 | A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend… |
CVE-2026-11392 | Medium | 6.1 | 2026-07-10 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versio… |
CVE-2026-15311 | Low | 3.5 | 2026-07-10 | A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the fi… |
CVE-2026-59833 | | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with san… | |
CVE-2026-58144 | Medium | 5.4 | 2026-07-09 | Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary scrip… |
CVE-2026-55424 | Medium | 5.4 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized a… |
CVE-2026-53963 | High | 7.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled… |
CVE-2026-53962 | Medium | 5.4 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar h… |
CVE-2026-60120 | Medium | 5.4 | 2026-07-09 | Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute a… |
CVE-2026-54002 | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize()… | |
CVE-2026-0279 | Medium | 6.1 | 2026-07-09 | Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Cl… |
CVE-2026-15202 | Medium | 4.3 | 2026-07-09 | A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler… |
CVE-2026-59214 | High | 7.3 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a sam… |
CVE-2026-53987 | Medium | 6.4 | 2026-07-09 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanC… |
CVE-2026-5005 | Medium | 5.4 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics Technology Consulting, Trade and Educa… |
CVE-2026-9253 | High | 7.2 | 2026-07-09 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter… |
CVE-2026-13441 | High | 7.2 | 2026-07-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_col… |
CVE-2026-5793 | Medium | 6.1 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows R… |
CVE-2026-2342 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Store… |
CVE-2026-6910 | Medium | 6.4 | 2026-07-09 | The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_produc… |
CVE-2026-4653 | Medium | 6.4 | 2026-07-09 | The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and incl… |
CVE-2026-31981 | Medium | 5.9 | 2026-07-09 | A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restricti… |
CVE-2026-15000 | High | 7.2 | 2026-07-09 | The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up… |
CVE-2026-14343 | Medium | 6.4 | 2026-07-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions… |
CVE-2026-13771 | Medium | 6.4 | 2026-07-09 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, a… |
CVE-2026-13334 | Medium | 6.1 | 2026-07-09 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due… |
CVE-2026-13253 | Medium | 6.4 | 2026-07-09 | The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-sea… |
CVE-2026-12170 | Medium | 6.4 | 2026-07-09 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-47646 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform… |
CVE-2026-15128 | Medium | 6.1 | 2026-07-08 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craft… |
CVE-2026-15127 | Medium | 6.1 | 2026-07-08 | Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craft… |
CVE-2026-5922 | | 2026-07-08 | The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage. | |
CVE-2026-55877 | Medium | 6.1 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html']… |
CVE-2026-6896 | High | 8.7 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain con… |
CVE-2026-58191 | Medium | 6.5 | 2026-07-08 | Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver uncond… |
CVE-2026-55596 | High | 8.7 | 2026-07-08 | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMe… |
CVE-2026-54527 | Critical | 9.0 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to inne… |
CVE-2026-13320 | High | 7.3 | 2026-07-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain c… |
CVE-2026-59929 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, v… |
CVE-2026-59926 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Ad… |
CVE-2026-59923 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowin… |