CWE-79 · Cross-site Scripting (page 13)
Page 13 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57357 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions. |
CVE-2026-57356 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. |
CVE-2026-57354 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. |
CVE-2026-57351 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. |
CVE-2026-57350 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. |
CVE-2026-57349 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions. |
CVE-2026-57345 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. |
CVE-2026-57344 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. |
CVE-2026-57343 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-57342 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. |
CVE-2026-27430 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. |
CVE-2026-27426 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions. |
CVE-2026-27425 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. |
CVE-2026-27408 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions. |
CVE-2026-27404 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. |
CVE-2026-27402 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions. |
CVE-2026-14449 | | 2026-07-02 | u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components | |
CVE-2025-69156 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. |
CVE-2025-69155 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. |
CVE-2025-69154 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. |
CVE-2025-69153 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. |
CVE-2025-69152 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. |
CVE-2026-13252 | Medium | 6.4 | 2026-07-02 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2026-10104 | Medium | 4.4 | 2026-07-02 | The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up t… |
CVE-2026-13704 | Medium | 6.4 | 2026-07-02 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]'… |
CVE-2026-10089 | Medium | 6.4 | 2026-07-02 | The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and inclu… |
CVE-2026-55791 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… | |
CVE-2026-55790 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can… | |
CVE-2026-55793 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript paylo… | |
CVE-2026-54263 | High | 7.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerab… |
CVE-2026-58263 | High | 7.2 | 2026-07-01 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed b… |
CVE-2026-55661 | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image rendere… | |
CVE-2026-55660 | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-… | |
CVE-2026-54720 | Medium | 5.4 | 2026-07-01 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS i… |
CVE-2026-14358 | Medium | 6.1 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension all… |
CVE-2026-57737 | Medium | 6.5 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme… |
CVE-2026-57722 | Medium | 5.9 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This… |
CVE-2026-34098 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129)… |
CVE-2026-34097 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101… |
CVE-2026-34096 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authent… |
CVE-2026-58038 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerabilit… |
CVE-2026-58037 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58032 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58030 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This… |
CVE-2026-58028 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2026-6283 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5220 | Medium | 6.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-58035 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58034 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerabili… |
CVE-2026-58031 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-53907 | Medium | 5.4 | 2026-07-01 | MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application lo… |
CVE-2026-13323 | Medium | 4.1 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Poli… |
CVE-2026-12142 | High | 7.2 | 2026-07-01 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all vers… |
CVE-2026-10095 | Medium | 6.4 | 2026-07-01 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1… |
CVE-2026-12754 | Medium | 6.1 | 2026-07-01 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions… |
CVE-2026-13733 | Medium | 6.4 | 2026-07-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-12732 | Medium | 6.4 | 2026-07-01 | The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and includ… |
CVE-2026-9107 | Medium | 6.4 | 2026-07-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component… |
CVE-2026-7517 | High | 7.2 | 2026-07-01 | The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in al… |
CVE-2026-58519 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-2387 | Medium | 6.4 | 2026-07-01 | The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_even… |
CVE-2026-13731 | High | 7.2 | 2026-07-01 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation'… |
CVE-2026-13443 | Medium | 6.4 | 2026-07-01 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versi… |
CVE-2026-13246 | Medium | 6.4 | 2026-07-01 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcod… |
CVE-2026-13015 | Medium | 6.1 | 2026-07-01 | The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and includ… |
CVE-2026-12135 | Medium | 6.4 | 2026-07-01 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all vers… |
CVE-2026-11380 | Medium | 6.4 | 2026-07-01 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insuffici… |
CVE-2026-57963 | Medium | 6.5 | 2026-07-01 | An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Thi… |
CVE-2026-56356 | Medium | 5.4 | 2026-06-30 | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Af… |
CVE-2026-50040 | Medium | 6.1 | 2026-06-30 | Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker c… |
CVE-2026-14147 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-14145 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-14068 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2026-14001 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-14000 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-13977 | Medium | 5.4 | 2026-06-30 | Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a c… |
CVE-2026-13957 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to inject… |
CVE-2026-13836 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-10585 | Medium | 5.4 | 2026-06-30 | A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript i… |
CVE-2026-11594 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. |
CVE-2025-36323 | Medium | 5.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr… |
CVE-2025-36320 | Medium | 6.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2026-11712 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
CVE-2026-11708 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
CVE-2026-10513 | High | 7.2 | 2026-06-30 | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' au… |
CVE-2026-58371 | Low | 3.1 | 2026-06-30 | SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson hel… |
CVE-2026-48307 | High | 8.8 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabil… |
CVE-2026-8403 | Medium | 6.1 | 2026-06-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-52760 | Medium | 6.1 | 2026-06-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse… |
CVE-2026-8141 | High | 7.2 | 2026-06-30 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up… |
CVE-2026-6954 | | 2026-06-30 | Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dy… | |
CVE-2026-6953 | | 2026-06-30 | HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a… | |
CVE-2026-56809 | Medium | 6.1 | 2026-06-30 | Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An ar… |
CVE-2026-12560 | Medium | 4.4 | 2026-06-30 | The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up… |
CVE-2026-12114 | Medium | 4.4 | 2026-06-30 | The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2026-54889 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Qu… | |
CVE-2026-53427 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scri… | |
CVE-2026-57958 | Medium | 6.1 | 2026-06-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenti… |
CVE-2026-57338 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
CVE-2026-57337 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions. |