CWE-79 · Cross-site Scripting (page 12)

Page 12 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-79 — newest first (page 12 of 100)
CVESeverityScorePublishedSummary
CVE-2026-59895Medium6.12026-07-08Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from pla…
CVE-2026-57439Medium5.02026-07-08CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while p…
CVE-2026-11903High8.02026-07-08Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue aff…
CVE-2026-60092Medium6.12026-07-08AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetI…
CVE-2026-58657Medium4.82026-07-08Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. P…
CVE-2026-56359Medium5.42026-07-08n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs…
CVE-2026-56283Medium5.42026-07-08Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. At…
CVE-2026-41122High7.12026-07-08Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30…
CVE-2026-8315Medium5.42026-07-08Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS. This…
CVE-2026-8310Medium6.12026-07-08Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Reflected XSS. Th…
CVE-2026-6820High7.22026-07-08The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, an…
CVE-2026-6740Medium6.42026-07-08The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon'…
CVE-2026-6459Medium6.42026-07-08The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Cale…
CVE-2026-6818High7.22026-07-08The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all version…
CVE-2026-6742Medium6.42026-07-08The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026…
CVE-2026-6371Medium4.82026-07-08Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc. LimRAD NAC allows Stored XSS. This i…
CVE-2025-14785Medium6.42026-07-08The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Si…
CVE-2026-12041Medium4.42026-07-08The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inc…
CVE-2026-11798Medium6.12026-07-08The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heat…
CVE-2026-10570Medium6.42026-07-08The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to…
CVE-2026-55437Medium5.42026-07-08Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine…
CVE-2026-36163Medium5.42026-07-07An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context o…
CVE-2026-36162Medium5.42026-07-07An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Java…
CVE-2026-556472026-07-07DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html wi…
CVE-2026-55592Low3.92026-07-07Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source…
CVE-2026-48954Medium6.12026-07-07Improper validation leads to a generic XSS vector in the language override feature.
CVE-2026-48953Medium6.12026-07-07Lack of escaping leads to an XSS vulnerability in the generic image output layout.
CVE-2026-48952Medium6.12026-07-07Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
CVE-2026-48951Medium6.12026-07-07Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
CVE-2026-48950Medium6.12026-07-07Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
CVE-2026-48949Medium6.12026-07-07Lack of validation leads to an XSS vulnerability in the MFA management views.
CVE-2025-12799Medium6.52026-07-07A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters i…
CVE-2026-129482026-07-07A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allow…
CVE-2026-8309Medium5.42026-07-07Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S…
CVE-2026-8306Medium6.12026-07-07Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S…
CVE-2026-11328Medium6.42026-07-07The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and in…
CVE-2026-536412026-07-06FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in…
CVE-2026-59710Medium6.12026-07-06showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape t…
CVE-2026-59711Medium6.12026-07-06showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeH…
CVE-2026-58402Medium5.42026-07-06Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the c…
CVE-2026-50133Medium6.12026-07-06Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .h…
CVE-2026-12154Medium6.42026-07-06The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of t…
CVE-2025-53831High8.22026-07-06DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud…
CVE-2025-8591Medium6.12026-07-06The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition a…
CVE-2026-14791Low3.52026-07-06A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesReq…
CVE-2026-14752Low3.52026-07-05A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of t…
CVE-2026-14704Medium4.32026-07-05A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the…
CVE-2026-14656Medium4.32026-07-04A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The man…
CVE-2026-14655Low2.42026-07-04A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.ph…
CVE-2026-14634Medium4.32026-07-04A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the fu…
CVE-2026-14633Medium4.32026-07-04A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of t…
CVE-2026-58524Medium5.42026-07-03Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf…
CVE-2026-58298High7.22026-07-03Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf…
CVE-2026-57977High7.12026-07-03Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf…
CVE-2026-28737High8.72026-07-03Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
CVE-2026-4322Medium6.12026-07-03Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency…
CVE-2026-9756Medium6.42026-07-03The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versi…
CVE-2026-4804Medium6.42026-07-03The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the…
CVE-2026-9148High7.22026-07-03The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and includ…
CVE-2026-8351Medium6.42026-07-03The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, a…
CVE-2026-9626Medium6.42026-07-03The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up…
CVE-2026-8892Medium6.42026-07-03The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fi…
CVE-2026-8489Medium6.42026-07-03The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored…
CVE-2026-13040High7.22026-07-03The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all ver…
CVE-2026-12734Medium6.42026-07-03The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorW…
CVE-2026-12731Medium6.42026-07-03The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTit…
CVE-2026-13377Medium4.82026-07-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Sto…
CVE-2026-13376Medium4.82026-07-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows S…
CVE-2026-13375Medium4.82026-07-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integr…
CVE-2026-13374Medium4.82026-07-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Int…
CVE-2026-13373Medium4.82026-07-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integr…
CVE-2026-59102Medium5.42026-07-02Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users'…
CVE-2026-58579Medium5.42026-07-02RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl…
CVE-2025-71385Medium6.12026-07-02Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG doc…
CVE-2026-86992026-07-02A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient serv…
CVE-2026-4772Medium5.42026-07-02Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Stored XSS. This…
CVE-2026-4770Medium4.62026-07-02Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows…
CVE-2026-57764Medium6.52026-07-02Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.
CVE-2026-57763Medium6.52026-07-02Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.
CVE-2026-57762Medium5.92026-07-02Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.
CVE-2026-57755Medium6.52026-07-02Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.
CVE-2026-57754Medium6.52026-07-02Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.
CVE-2026-57686High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.
CVE-2026-57684Medium6.52026-07-02Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.
CVE-2026-57682High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.
CVE-2026-57678High7.12026-07-02Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This…
CVE-2026-57675High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.
CVE-2026-57674High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
CVE-2026-57673High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.
CVE-2026-57672High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.
CVE-2026-57671High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.
CVE-2026-57670High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.
CVE-2026-57625Critical9.62026-07-02Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.
CVE-2026-57426High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.
CVE-2026-57366High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.
CVE-2026-57362High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.
CVE-2026-57361High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.
CVE-2026-57360High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.
CVE-2026-57359High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.
CVE-2026-57358High7.12026-07-02Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.