CWE-79 · Cross-site Scripting (page 15)
Page 15 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84812 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. |
CVE-2026-84774 | Medium | 6.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. |
CVE-2026-84773 | High | 7.2 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. |
CVE-2026-84765 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. |
CVE-2026-84763 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. |
CVE-2026-81776 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
CVE-2026-81773 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
CVE-2026-81300 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. |
CVE-2026-81295 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. |
CVE-2026-81292 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. |
CVE-2026-81282 | Medium | 6.5 | 2026-09-03 | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. |
CVE-2026-81281 | Medium | 6.5 | 2026-09-03 | Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. |
CVE-2026-85230 | Medium | 5.4 | 2026-09-03 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
CVE-2026-85227 | Medium | 6.1 | 2026-09-03 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
CVE-2026-56128 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the des… |
CVE-2026-56127 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr p… |
CVE-2026-56126 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configur… |
CVE-2026-84815 | Medium | 5.8 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects E… |
CVE-2026-85159 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
CVE-2026-85158 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
CVE-2026-85022 | Low | 3.5 | 2026-09-03 | A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webap… |
CVE-2026-85021 | Medium | 4.3 | 2026-09-03 | A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of th… |
CVE-2026-78000 | | 2026-09-03 | Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task ha… | |
CVE-2026-76178 | | 2026-09-03 | A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with ad… | |
CVE-2026-3852 | Medium | 6.4 | 2026-09-03 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all vers… |
CVE-2026-2573 | Medium | 6.4 | 2026-09-03 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-75134 | Medium | 6.4 | 2026-09-02 | SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious… |
CVE-2026-84677 | Medium | 5.4 | 2026-09-02 | Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pa… |
CVE-2026-84673 | High | 8.8 | 2026-09-02 | Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allo… |
CVE-2026-84665 | High | 8.0 | 2026-09-02 | Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing… |
CVE-2026-84648 | High | 8.8 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a… |
CVE-2026-83547 | Medium | 6.8 | 2026-09-02 | The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could… |
CVE-2026-82884 | Medium | 6.8 | 2026-09-02 | The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which… |
CVE-2025-15692 | Low | 3.5 | 2026-09-02 | The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which coul… |
CVE-2024-3773 | Medium | 5.9 | 2026-09-02 | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2026-81201 | Medium | 6.1 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affect… |
CVE-2026-81167 | Medium | 4.8 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XS… |
CVE-2026-81160 | Medium | 6.1 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affec… |
CVE-2026-76782 | High | 7.3 | 2026-09-02 | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. |
CVE-2026-76759 | High | 7.3 | 2026-09-02 | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. |
CVE-2026-18986 | Medium | 4.8 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affec… |
CVE-2026-84803 | Critical | 9.0 | 2026-09-02 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable… |
CVE-2026-84793 | Medium | 4.8 | 2026-09-02 | Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Admin… |
CVE-2026-84781 | Medium | 6.5 | 2026-09-02 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. |
CVE-2026-83562 | Medium | 6.5 | 2026-09-02 | Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. |
CVE-2026-81775 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
CVE-2026-81771 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
CVE-2026-81770 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. |
CVE-2026-81289 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions. |
CVE-2026-81288 | High | 7.1 | 2026-09-02 | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. |
CVE-2026-75528 | High | 7.2 | 2026-09-02 | The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and includin… |
CVE-2025-7963 | Medium | 6.4 | 2026-09-02 | The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up t… |
CVE-2026-82883 | High | 7.1 | 2026-09-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue… |
CVE-2026-3850 | Medium | 6.4 | 2026-09-02 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all version… |
CVE-2026-81807 | High | 8.8 | 2026-09-02 | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbit… |
CVE-2026-81737 | High | 8.8 | 2026-09-02 | The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it… |
CVE-2026-77792 | High | 7.5 | 2026-09-02 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administ… |
CVE-2026-19723 | High | 7.1 | 2026-09-02 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before out… |
CVE-2026-19719 | Medium | 6.8 | 2026-09-02 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript… |
CVE-2026-12865 | High | 7.1 | 2026-09-02 | The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its adm… |
CVE-2025-15664 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled cl… |
CVE-2025-15663 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled cli… |
CVE-2026-3851 | Medium | 6.4 | 2026-09-02 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and inclu… |
CVE-2026-84438 | Low | 3.5 | 2026-09-02 | A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component A… |
CVE-2026-84437 | Low | 3.5 | 2026-09-02 | A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the co… |
CVE-2026-84701 | Medium | 5.4 | 2026-09-02 | NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Att… |
CVE-2026-84695 | High | 8.7 | 2026-09-02 | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores… |
CVE-2026-84477 | Medium | 5.4 | 2026-09-01 | AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scrip… |
CVE-2026-84371 | Medium | 5.4 | 2026-09-01 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 unti… |
CVE-2026-84370 | High | 8.2 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-84369 | Medium | 6.1 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-73781 | High | 8.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) att… |
CVE-2026-73524 | Medium | 6.1 | 2026-09-01 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by em… |
CVE-2026-73731 | Medium | 6.1 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected c… |
CVE-2026-73703 | High | 8.8 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cr… |
CVE-2026-73700 | Critical | 9.0 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a s… |
CVE-2026-84232 | Medium | 5.4 | 2026-09-01 | A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., te… |
CVE-2026-84136 | Medium | 6.1 | 2026-09-01 | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-7877 | Medium | 6.4 | 2026-09-01 | The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions… |
CVE-2026-19471 | | 2026-09-01 | Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on… | |
CVE-2026-84193 | | 2026-09-01 | LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields includ… | |
CVE-2026-84192 | High | 7.1 | 2026-09-01 | LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without es… |
CVE-2026-84191 | Medium | 6.1 | 2026-09-01 | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDist… |
CVE-2026-84189 | High | 8.1 | 2026-09-01 | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url… |
CVE-2026-84188 | Medium | 4.8 | 2026-09-01 | LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbati… |
CVE-2026-19914 | High | 7.2 | 2026-09-01 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including… |
CVE-2026-16788 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode… |
CVE-2026-16786 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortc… |
CVE-2026-15101 | Medium | 6.4 | 2026-09-01 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7… |
CVE-2026-75980 | Medium | 6.4 | 2026-09-01 | The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading… |
CVE-2026-75964 | Medium | 6.1 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-18488 | Medium | 6.4 | 2026-09-01 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up… |
CVE-2026-75965 | Medium | 6.4 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-19796 | High | 7.2 | 2026-09-01 | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][styl… |
CVE-2026-19573 | High | 7.2 | 2026-09-01 | The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, an… |
CVE-2026-16787 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all v… |
CVE-2026-13203 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of… |
CVE-2026-12747 | Medium | 6.4 | 2026-09-01 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and inc… |
CVE-2026-82396 | Medium | 5.4 | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller… |
CVE-2026-82229 | High | 7.1 | 2026-08-31 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions. |