CWE-79 · Cross-site Scripting (page 14)
Page 14 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57336 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. |
CVE-2026-57333 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. |
CVE-2026-57330 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. |
CVE-2026-57329 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions. |
CVE-2026-57328 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57326 | Medium | 6.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57320 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. |
CVE-2026-13570 | Low | 3.5 | 2026-06-29 | A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the compo… |
CVE-2026-13567 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component PO… |
CVE-2026-13558 | Low | 3.5 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of t… |
CVE-2026-13557 | Medium | 4.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/mod_room/controll… |
CVE-2026-13556 | Medium | 4.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?act… |
CVE-2026-13554 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2026-13536 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn lea… |
CVE-2026-13504 | Low | 3.5 | 2026-06-28 | A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component M… |
CVE-2026-13499 | Medium | 4.3 | 2026-06-28 | A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file login_register.php of the co… |
CVE-2026-13295 | Medium | 6.4 | 2026-06-27 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including… |
CVE-2026-12399 | Medium | 4.4 | 2026-06-27 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… |
CVE-2026-11783 | Medium | 6.4 | 2026-06-27 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2026-11597 | Medium | 6.4 | 2026-06-27 | The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to… |
CVE-2026-13245 | Medium | 6.1 | 2026-06-27 | The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and includ… |
CVE-2026-13335 | Medium | 6.4 | 2026-06-27 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and… |
CVE-2026-11356 | Medium | 4.4 | 2026-06-27 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settin… |
CVE-2026-50767 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an auth… |
CVE-2026-50766 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticate… |
CVE-2026-50765 | Medium | 6.1 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions… |
CVE-2026-52781 | Medium | 6.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* a… |
CVE-2026-44696 | Medium | 5.7 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config… |
CVE-2026-57656 | Medium | 5.9 | 2026-06-26 | Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions. |
CVE-2026-57651 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions. |
CVE-2026-57650 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. |
CVE-2026-57638 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. |
CVE-2026-57629 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions. |
CVE-2026-57618 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions. |
CVE-2026-57617 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions. |
CVE-2026-57431 | Medium | 6.5 | 2026-06-26 | Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions. |
CVE-2026-57325 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. |
CVE-2026-57322 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions. |
CVE-2026-57319 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. |
CVE-2026-57317 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions. |
CVE-2026-57314 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions. |
CVE-2026-57313 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions. |
CVE-2026-57312 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. |
CVE-2026-56072 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. |
CVE-2026-56047 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions. |
CVE-2026-56046 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. |
CVE-2026-56045 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. |
CVE-2026-56044 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. |
CVE-2026-56043 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions. |
CVE-2026-56041 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions. |
CVE-2026-56040 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions. |
CVE-2026-56039 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions. |
CVE-2026-56011 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions. |
CVE-2025-68075 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions. |
CVE-2025-68074 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions. |
CVE-2026-57620 | Medium | 6.5 | 2026-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS… |
CVE-2026-6658 | Medium | 5.4 | 2026-06-26 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `d… |
CVE-2026-8661 | Medium | 4.8 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers… |
CVE-2026-50745 | Medium | 6.1 | 2026-06-26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best pra… |
CVE-2026-50742 | Medium | 5.4 | 2026-06-26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused… |
CVE-2026-50740 | Medium | 5.4 | 2026-06-26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could expl… |
CVE-2026-13083 | Medium | 6.9 | 2026-06-26 | A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker wit… |
CVE-2020-37256 | Medium | 5.4 | 2026-06-25 | Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page edi… |
CVE-2026-9086 | High | 7.3 | 2026-06-25 | A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registra… |
CVE-2026-54025 | Medium | 5.4 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact previ… |
CVE-2026-48942 | Medium | 6.1 | 2026-06-25 | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping. |
CVE-2026-48940 | Low | 3.4 | 2026-06-25 | A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 store… |
CVE-2026-56071 | High | 7.1 | 2026-06-25 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. |
CVE-2026-56051 | High | 7.1 | 2026-06-25 | Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions. |
CVE-2026-56042 | High | 7.1 | 2026-06-25 | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions. |
CVE-2026-56014 | High | 7.1 | 2026-06-25 | Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions. |
CVE-2026-56006 | High | 7.1 | 2026-06-25 | Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions. |
CVE-2026-56005 | High | 7.1 | 2026-06-25 | Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions. |
CVE-2026-10712 | High | 8.0 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain… |
CVE-2026-10086 | High | 8.7 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-10833 | Medium | 6.4 | 2026-06-25 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'config… |
CVE-2026-9780 | High | 8.8 | 2026-06-25 | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2026-7569 | High | 8.8 | 2026-06-25 | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2026-39900 | Medium | 6.1 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_pro… |
CVE-2026-55570 | Critical | 9.0 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) whe… |
CVE-2026-54759 | | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYua… | |
CVE-2026-54158 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell con… |
CVE-2026-54070 | High | 7.1 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README f… |
CVE-2026-54067 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag w… |
CVE-2026-50551 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribu… |
CVE-2026-39897 | Medium | 6.1 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the html_auth_footer. Th… |
CVE-2026-52807 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), wh… | |
CVE-2026-52798 | High | 8.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inser… |
CVE-2026-47733 | Medium | 4.4 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders use… |
CVE-2026-11998 | High | 7.6 | 2026-06-24 | A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execut… |
CVE-2026-53950 | High | 7.5 | 2026-06-24 | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts… |
CVE-2026-49220 | Medium | 5.7 | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execu… |
CVE-2026-50712 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… | |
CVE-2026-50711 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… | |
CVE-2026-50710 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number… | |
CVE-2026-50709 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… | |
CVE-2026-50708 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… | |
CVE-2026-50705 | | 2026-06-24 | A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboar… | |
CVE-2026-50704 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… | |
CVE-2026-50703 | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |