CWE-79 · Cross-site Scripting (page 14)
Page 14 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86712 | High | 8.8 | 2026-09-08 | SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the No… |
CVE-2026-76931 | Medium | 6.4 | 2026-09-08 | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including… |
CVE-2026-12230 | Medium | 6.4 | 2026-09-08 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_cust… |
CVE-2026-86550 | Medium | 6.5 | 2026-09-08 | NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirect… |
CVE-2026-58113 | Medium | 6.1 | 2026-09-08 | A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versio… |
CVE-2026-84820 | High | 7.1 | 2026-09-08 | Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. |
CVE-2026-84818 | High | 7.1 | 2026-09-08 | Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. |
CVE-2026-84817 | High | 7.1 | 2026-09-08 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. |
CVE-2026-81798 | High | 7.1 | 2026-09-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affec… |
CVE-2026-86491 | Low | 3.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads |
CVE-2026-86484 | Medium | 4.6 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS |
CVE-2026-86483 | Medium | 5.4 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible |
CVE-2026-86440 | Medium | 5.4 | 2026-09-07 | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration co… |
CVE-2026-86431 | High | 7.2 | 2026-09-07 | league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an… |
CVE-2026-6431 | High | 7.2 | 2026-09-07 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-86301 | Low | 3.5 | 2026-09-07 | A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php… |
CVE-2026-78325 | | 2026-09-07 | Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary Java… | |
CVE-2026-2390 | Medium | 6.4 | 2026-09-07 | The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including… |
CVE-2026-86294 | Medium | 4.3 | 2026-09-07 | A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-setti… |
CVE-2026-86278 | Medium | 4.3 | 2026-09-07 | A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the f… |
CVE-2026-86264 | Medium | 4.3 | 2026-09-07 | A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/… |
CVE-2026-86244 | Medium | 4.3 | 2026-09-07 | A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/contro… |
CVE-2026-86238 | Medium | 4.3 | 2026-09-07 | A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the comp… |
CVE-2026-86226 | Low | 3.5 | 2026-09-06 | A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php… |
CVE-2026-86216 | Medium | 4.3 | 2026-09-06 | A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details… |
CVE-2026-86181 | Low | 3.5 | 2026-09-06 | A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile… |
CVE-2026-84219 | High | 7.5 | 2026-09-06 | The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to st… |
CVE-2026-84028 | Medium | 6.8 | 2026-09-06 | The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing user… |
CVE-2026-86197 | | 2026-09-05 | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets with… | |
CVE-2026-86188 | High | 7.2 | 2026-09-05 | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other… |
CVE-2026-76573 | Medium | 6.4 | 2026-09-05 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all version… |
CVE-2026-85414 | Medium | 6.4 | 2026-09-05 | The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and… |
CVE-2026-83625 | High | 7.2 | 2026-09-05 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.1… |
CVE-2026-75586 | Medium | 6.1 | 2026-09-05 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, a… |
CVE-2026-84935 | High | 8.0 | 2026-09-05 | The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not es… |
CVE-2026-84934 | High | 8.0 | 2026-09-05 | The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which i… |
CVE-2026-84931 | Medium | 6.8 | 2026-09-05 | The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's… |
CVE-2026-84930 | Medium | 6.8 | 2026-09-05 | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in… |
CVE-2026-84899 | Medium | 6.8 | 2026-09-05 | The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users… |
CVE-2026-84896 | Medium | 6.8 | 2026-09-05 | The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowi… |
CVE-2026-84022 | Medium | 6.8 | 2026-09-05 | The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowi… |
CVE-2026-84021 | Medium | 6.8 | 2026-09-05 | The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that c… |
CVE-2026-83544 | Medium | 6.8 | 2026-09-05 | The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing use… |
CVE-2026-82846 | Medium | 6.8 | 2026-09-05 | The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors… |
CVE-2026-81404 | High | 7.1 | 2026-09-05 | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenti… |
CVE-2026-78438 | High | 7.2 | 2026-09-05 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to… |
CVE-2026-77830 | High | 7.2 | 2026-09-05 | The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placehol… |
CVE-2026-3853 | Medium | 6.4 | 2026-09-05 | The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in… |
CVE-2026-19861 | Medium | 4.7 | 2026-09-05 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it… |
CVE-2026-19769 | High | 7.2 | 2026-09-05 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Conf… |
CVE-2026-18843 | Medium | 6.1 | 2026-09-05 | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Paramete… |
CVE-2026-18406 | High | 7.2 | 2026-09-05 | The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field En… |
CVE-2026-16649 | High | 7.2 | 2026-09-05 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due… |
CVE-2026-15984 | High | 7.2 | 2026-09-05 | The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to… |
CVE-2025-15694 | Low | 3.5 | 2026-09-05 | The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could… |
CVE-2026-8625 | Medium | 6.4 | 2026-09-05 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (C… |
CVE-2026-8623 | Medium | 6.4 | 2026-09-05 | The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (c… |
CVE-2026-77263 | High | 7.2 | 2026-09-05 | The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content… |
CVE-2026-77233 | High | 7.2 | 2026-09-05 | The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content… |
CVE-2026-18404 | Medium | 6.4 | 2026-09-05 | The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp da… |
CVE-2025-14945 | Medium | 5.4 | 2026-09-05 | The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all… |
CVE-2026-52772 | Medium | 5.5 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute a… |
CVE-2022-26961 | Medium | 5.4 | 2026-09-04 | Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.j… |
CVE-2026-73848 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An… | |
CVE-2026-53758 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which mean… | |
CVE-2026-78849 | Medium | 5.4 | 2026-09-04 | Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute… |
CVE-2026-38961 | Medium | 5.4 | 2026-09-04 | Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authe… |
CVE-2026-79419 | High | 8.7 | 2026-09-04 | A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insuffici… |
CVE-2026-79418 | High | 8.7 | 2026-09-04 | EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of us… |
CVE-2026-75170 | Medium | 6.1 | 2026-09-04 | Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated atta… |
CVE-2022-35499 | High | 7.1 | 2026-09-04 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended t… |
CVE-2022-35497 | Medium | 5.4 | 2026-09-04 | In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site… |
CVE-2026-8447 | Medium | 6.1 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface. |
CVE-2026-19727 | Medium | 6.1 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and El… |
CVE-2026-14466 | Medium | 4.3 | 2026-09-04 | It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions… |
CVE-2026-77818 | Medium | 6.1 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and El… |
CVE-2026-19057 | Medium | 5.4 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows… |
CVE-2026-85613 | High | 8.2 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attacke… |
CVE-2026-85601 | Medium | 5.4 | 2026-09-04 | Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and Mar… |
CVE-2026-85600 | Medium | 5.4 | 2026-09-04 | Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.sve… |
CVE-2026-85599 | High | 7.2 | 2026-09-04 | Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are wri… |
CVE-2026-85598 | Medium | 6.4 | 2026-09-04 | Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payl… |
CVE-2026-85593 | Medium | 5.4 | 2026-09-04 | phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on s… |
CVE-2026-85577 | Medium | 5.4 | 2026-09-04 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitr… |
CVE-2026-18957 | Medium | 5.4 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. … |
CVE-2026-85541 | Medium | 5.4 | 2026-09-04 | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in… |
CVE-2026-27086 | Medium | 6.5 | 2026-09-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects… |
CVE-2026-85229 | Medium | 6.1 | 2026-09-04 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster… |
CVE-2026-80190 | Medium | 6.1 | 2026-09-04 | Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP hea… |
CVE-2026-80180 | Medium | 6.1 | 2026-09-04 | Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to vers… |
CVE-2026-85406 | Low | 3.5 | 2026-09-04 | A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulati… |
CVE-2026-85405 | Low | 3.5 | 2026-09-04 | A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of… |
CVE-2026-85382 | Medium | 4.3 | 2026-09-04 | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmls… |
CVE-2026-85453 | Medium | 6.1 | 2026-09-03 | MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publ… |
CVE-2026-85061 | Critical | 10.0 | 2026-09-03 | MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live… |
CVE-2026-85207 | Low | 3.5 | 2026-09-03 | A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such… |
CVE-2026-82024 | Medium | 5.4 | 2026-09-03 | LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to i… |
CVE-2026-85303 | Medium | 6.5 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored… |
CVE-2026-85302 | Medium | 6.5 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allo… |
CVE-2026-84848 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. |