CWE-79 · Cross-site Scripting (page 12)
Page 12 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7438 | Medium | 6.4 | 2026-09-11 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_i… |
CVE-2026-78172 | Medium | 6.1 | 2026-09-11 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, a… |
CVE-2026-77150 | Medium | 6.1 | 2026-09-11 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and… |
CVE-2026-19985 | Medium | 6.1 | 2026-09-11 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'po… |
CVE-2026-18964 | Medium | 6.1 | 2026-09-11 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Refl… |
CVE-2026-18579 | High | 7.2 | 2026-09-11 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and i… |
CVE-2026-18562 | Medium | 6.1 | 2026-09-11 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter… |
CVE-2026-89145 | Medium | 4.2 | 2026-09-11 | Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependenci… |
CVE-2026-36392 | Medium | 5.4 | 2026-09-10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's ti… |
CVE-2022-26962 | Medium | 5.4 | 2026-09-10 | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name… |
CVE-2026-88060 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88058 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88057 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88055 | Medium | 5.5 | 2026-09-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager… |
CVE-2026-84819 | High | 7.1 | 2026-09-10 | Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
CVE-2026-84816 | High | 7.1 | 2026-09-10 | Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. |
CVE-2026-81795 | High | 7.1 | 2026-09-10 | Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. |
CVE-2026-81791 | Medium | 6.5 | 2026-09-10 | Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
CVE-2026-81782 | Medium | 6.5 | 2026-09-10 | Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
CVE-2026-88921 | | 2026-09-10 | MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attrib… | |
CVE-2026-88869 | Critical | 9.3 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint… |
CVE-2026-88868 | High | 8.7 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and des… |
CVE-2026-88867 | High | 8.7 | 2026-09-10 | WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/cat… |
CVE-2026-88866 | High | 8.7 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails… |
CVE-2026-12683 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-12682 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-78302 | | 2026-09-10 | Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Mu… | |
CVE-2026-5399 | Medium | 6.4 | 2026-09-10 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and inclu… |
CVE-2026-15889 | Medium | 6.4 | 2026-09-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due… |
CVE-2026-81635 | Medium | 5.4 | 2026-09-10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses… |
CVE-2026-85645 | Medium | 6.1 | 2026-09-10 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_ac… |
CVE-2026-0308 | | 2026-09-10 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a… | |
CVE-2026-76562 | High | 7.2 | 2026-09-10 | The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and incl… |
CVE-2026-4657 | Medium | 6.4 | 2026-09-10 | The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and includi… |
CVE-2026-15820 | Medium | 6.4 | 2026-09-10 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and… |
CVE-2026-15796 | Medium | 6.4 | 2026-09-10 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and in… |
CVE-2026-87870 | Medium | 6.4 | 2026-09-10 | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in al… |
CVE-2026-87926 | Medium | 4.3 | 2026-09-10 | A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the… |
CVE-2026-87923 | Medium | 4.3 | 2026-09-09 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown f… |
CVE-2026-87995 | High | 8.7 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.sve… |
CVE-2026-75308 | Medium | 6.1 | 2026-09-09 | yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can uploa… |
CVE-2026-75307 | Medium | 6.1 | 2026-09-09 | zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. |
CVE-2026-71803 | Medium | 5.4 | 2026-09-09 | money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName paramete… |
CVE-2026-71802 | Medium | 5.4 | 2026-09-09 | A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HT… |
CVE-2026-54694 | Critical | 9.6 | 2026-09-09 | SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with th… |
CVE-2026-18147 | High | 8.1 | 2026-09-09 | A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password… |
CVE-2026-86772 | Medium | 5.4 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rende… |
CVE-2026-87814 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before… |
CVE-2026-87813 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML wit… |
CVE-2026-87812 | Medium | 6.8 | 2026-09-09 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img… |
CVE-2026-87811 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft maliciou… |
CVE-2025-3271 | | 2026-09-09 | Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS | |
CVE-2026-14989 | High | 7.2 | 2026-09-09 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' paramet… |
CVE-2026-17149 | Medium | 6.4 | 2026-09-09 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2025-7062 | | 2026-09-09 | A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and includi… | |
CVE-2026-85418 | Medium | 5.4 | 2026-09-09 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML… |
CVE-2026-83593 | High | 7.2 | 2026-09-09 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation'… |
CVE-2026-83541 | Medium | 6.8 | 2026-09-09 | The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute… |
CVE-2025-15690 | Medium | 6.8 | 2026-09-09 | The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it gener… |
CVE-2026-19945 | Medium | 6.4 | 2026-09-09 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2… |
CVE-2026-84293 | High | 7.2 | 2026-09-09 | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versio… |
CVE-2026-7804 | Medium | 6.1 | 2026-09-09 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up t… |
CVE-2026-77187 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in a… |
CVE-2026-77186 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions… |
CVE-2026-75966 | Medium | 6.4 | 2026-09-09 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all ver… |
CVE-2026-19797 | Medium | 6.1 | 2026-09-09 | The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and i… |
CVE-2026-13709 | Medium | 6.4 | 2026-09-09 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setti… |
CVE-2026-13359 | High | 7.2 | 2026-09-09 | The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_c… |
CVE-2026-87632 | Medium | 4.3 | 2026-09-09 | Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Ch… |
CVE-2026-85982 | Critical | 9.0 | 2026-09-08 | The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log c… |
CVE-2026-78742 | Medium | 6.1 | 2026-09-08 | Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction. |
CVE-2026-78741 | Medium | 6.1 | 2026-09-08 | Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature. |
CVE-2026-78738 | Medium | 6.1 | 2026-09-08 | Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature. |
CVE-2026-85630 | Medium | 6.1 | 2026-09-08 | HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fi… |
CVE-2026-85485 | Medium | 6.1 | 2026-09-08 | HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wra… |
CVE-2026-85484 | Medium | 6.1 | 2026-09-08 | HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, Che… |
CVE-2026-84942 | High | 8.7 | 2026-09-08 | Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write perm… |
CVE-2026-79905 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-76002 | Medium | 6.1 | 2026-09-08 | ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulner… |
CVE-2026-75993 | High | 8.5 | 2026-09-08 | ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a… |
CVE-2026-75742 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75741 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75740 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75739 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75738 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75737 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75736 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75735 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75734 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75733 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75731 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75730 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75729 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75727 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-75725 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-75724 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-75722 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-75720 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-75719 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-75718 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |