CWE-79 · Cross-site Scripting (page 16)
Page 16 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48768 | Critical | 9.3 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized f… |
CVE-2026-44644 | Medium | 6.1 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in th… |
CVE-2026-54386 | Medium | 6.1 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary Jav… |
CVE-2026-48821 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer… |
CVE-2026-48823 | Medium | 4.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionali… |
CVE-2026-48822 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversi… |
CVE-2026-10850 | Medium | 5.4 | 2026-06-17 | Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the A… |
CVE-2026-40720 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. |
CVE-2025-69140 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions. |
CVE-2025-68524 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions. |
CVE-2026-9570 | High | 7.1 | 2026-06-17 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containin… |
CVE-2026-8607 | Medium | 6.4 | 2026-06-17 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-8494 | Medium | 6.4 | 2026-06-17 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions… |
CVE-2026-8089 | High | 7.1 | 2026-06-17 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a… |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-54192 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
CVE-2026-54189 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54188 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-49778 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
CVE-2026-49074 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2026-48788 | High | 8.2 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-… |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-41557 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. |
CVE-2026-40765 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. |
CVE-2026-39597 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. |
CVE-2026-39548 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
CVE-2026-27870 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable s… | |
CVE-2026-22339 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-22328 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. |
CVE-2026-12463 | Medium | 4.7 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to i… |
CVE-2026-12459 | Medium | 6.1 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-11975 | | 2026-06-17 | Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary… | |
CVE-2025-69151 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions. |
CVE-2025-69104 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions. |
CVE-2025-59560 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions. |
CVE-2025-31013 | High | 7.1 | 2026-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Th… |
CVE-2024-49269 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. |
CVE-2026-48294 | High | 7.4 | 2026-06-17 | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could e… |
CVE-2026-46955 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. D… |
CVE-2026-46856 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-46853 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-12425 | Medium | 6.1 | 2026-06-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Si… |
CVE-2024-30476 | Medium | 5.4 | 2026-06-16 | PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentia… |
CVE-2026-54198 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions. |
CVE-2026-54191 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. |
CVE-2026-39437 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions. |
CVE-2026-10093 | Medium | 6.4 | 2026-06-16 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all… |
CVE-2026-48157 | Medium | 6.1 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpExceptio… |
CVE-2026-52702 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. |
CVE-2026-49773 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions. |
CVE-2026-49055 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions. |
CVE-2026-48966 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions. |
CVE-2026-48885 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. |
CVE-2026-48880 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions. |
CVE-2026-48876 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions. |
CVE-2026-48871 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions. |
CVE-2026-48870 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions. |
CVE-2026-48867 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions. |
CVE-2026-48838 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. |
CVE-2026-45437 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions. |
CVE-2026-42775 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions. |
CVE-2026-42688 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions. |
CVE-2026-42686 | High | 7.1 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions. |
CVE-2026-42663 | Medium | 6.5 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions. |
CVE-2026-42658 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions. |
CVE-2026-42656 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions. |
CVE-2026-42650 | High | 7.2 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions. |
CVE-2026-42649 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions. |
CVE-2026-41556 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions. |
CVE-2026-40791 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions. |
CVE-2026-40787 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions. |
CVE-2026-40770 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. |
CVE-2026-40732 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. |
CVE-2026-39540 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions. |
CVE-2026-39514 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. |
CVE-2026-39507 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. |
CVE-2026-39491 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions. |
CVE-2026-39463 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. |
CVE-2026-39451 | Medium | 6.3 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions. |
CVE-2026-39449 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. |
CVE-2026-39447 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. |
CVE-2026-39435 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions. |
CVE-2026-34902 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions. |
CVE-2026-34900 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. |
CVE-2026-23970 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. |
CVE-2025-68872 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions. |
CVE-2025-68851 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. |
CVE-2025-68840 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. |
CVE-2026-50883 | Critical | 9.6 | 2026-06-15 | An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload. |
CVE-2026-50876 | Medium | 5.4 | 2026-06-15 | A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2026-37216 | Medium | 6.1 | 2026-06-15 | Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add. |
CVE-2026-36521 | Medium | 6.1 | 2026-06-15 | PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module. |
CVE-2026-49294 | Medium | 6.1 | 2026-06-15 | Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cros… |
CVE-2025-15659 | Medium | 6.5 | 2026-06-15 | Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions. |
CVE-2025-15658 | Medium | 5.9 | 2026-06-15 | Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions. |
CVE-2016-20084 | High | 7.2 | 2026-06-15 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar se… |
CVE-2016-20070 | Medium | 6.4 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to… |