CWE-79 · Cross-site Scripting (page 16)

Page 16 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-79 — newest first (page 16 of 100)
CVESeverityScorePublishedSummary
CVE-2026-82224High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
CVE-2026-82221High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
CVE-2026-818872026-08-31Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, in…
CVE-2026-81778Medium6.52026-08-31Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
CVE-2026-81768High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
CVE-2026-81765High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
CVE-2026-81764High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
CVE-2026-81298High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
CVE-2026-81291High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
CVE-2026-81290High7.12026-08-31Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
CVE-2026-54179Medium4.42026-08-31backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio…
CVE-2025-63607Medium6.12026-08-31TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitt…
CVE-2026-82805Medium4.32026-08-31A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of…
CVE-2026-51153Medium5.42026-08-31Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run…
CVE-2026-82700Medium4.32026-08-31A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php o…
CVE-2026-780772026-08-31Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized col…
CVE-2026-76986Medium6.12026-08-31Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of…
CVE-2026-76985Medium5.42026-08-31Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions…
CVE-2026-76984Medium5.42026-08-31Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> hea…
CVE-2026-76983Medium5.42026-08-31Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLab…
CVE-2026-76982Medium5.42026-08-31Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag i…
CVE-2026-75802Medium5.42026-08-31AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the l…
CVE-2026-82881Medium5.42026-08-31Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers…
CVE-2026-82868Medium6.12026-08-31@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML…
CVE-2026-82867Medium6.12026-08-31@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating…
CVE-2026-82865Medium4.42026-08-31pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to…
CVE-2026-82664Medium4.32026-08-31A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController…
CVE-2026-82625Medium4.32026-08-31A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Regis…
CVE-2026-82622Low3.52026-08-31A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/edita…
CVE-2026-40464Medium5.42026-08-31NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with…
CVE-2026-778502026-08-31Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The rela…
CVE-2026-82601Medium4.32026-08-31A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lea…
CVE-2026-82554Medium4.32026-08-30A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/add_customer.php. This manipulation of the a…
CVE-2026-82654High8.92026-08-30SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a blo…
CVE-2026-82653High8.92026-08-30SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated…
CVE-2026-82646Medium6.12026-08-30WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicio…
CVE-2026-82642High8.82026-08-30Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that…
CVE-2026-82488Low3.52026-08-30A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the…
CVE-2026-82483Low3.52026-08-30A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the comp…
CVE-2026-82482Low3.52026-08-30A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.ph…
CVE-2026-81660High8.82026-08-30The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web fo…
CVE-2026-78364Low3.52026-08-30The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, whi…
CVE-2026-76585High8.82026-08-30The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpo…
CVE-2026-14835Medium6.82026-08-30The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved fro…
CVE-2026-14307High7.12026-08-30The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served…
CVE-2026-82451Medium6.12026-08-29Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated a…
CVE-2026-76546Medium6.82026-08-29The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as cont…
CVE-2026-55779Medium5.42026-08-28Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveA…
CVE-2026-55696Medium4.32026-08-28PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses ge…
CVE-2026-76798Medium6.32026-08-28The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them f…
CVE-2026-76794Medium4.62026-08-28MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can i…
CVE-2026-55566Medium4.32026-08-28Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp…
CVE-2026-55549Medium6.52026-08-28Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src…
CVE-2026-50980Medium6.12026-08-28Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScri…
CVE-2026-39071Medium5.42026-08-28WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privil…
CVE-2026-39070Medium4.82026-08-28WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged…
CVE-2026-81760High7.12026-08-28Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue af…
CVE-2026-6176High7.22026-08-28The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up…
CVE-2026-5953Medium6.12026-08-28Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. …
CVE-2026-5934High7.22026-08-28The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input s…
CVE-2026-5800Medium6.12026-08-28Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf…
CVE-2026-4378Medium5.42026-08-28Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack…
CVE-2026-3423Medium6.42026-08-28The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, a…
CVE-2026-38725Medium5.42026-08-28xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in a…
CVE-2026-37710Medium6.12026-08-28Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function
CVE-2026-780732026-08-28Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors
CVE-2026-780712026-08-28Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attr…
CVE-2026-6128Medium6.42026-08-28The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all…
CVE-2026-5510Medium6.42026-08-28The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all ve…
CVE-2026-9548Medium6.52026-08-28An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22…
CVE-2026-82123Medium6.52026-08-28Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.
CVE-2026-78238Medium5.42026-08-28SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVE-2026-77838Medium5.42026-08-28SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVE-2026-73827Medium5.42026-08-28SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVE-2026-6286High7.22026-08-28The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in version…
CVE-2026-4246Medium6.12026-08-28The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all version…
CVE-2026-40541Critical9.02026-08-28An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22…
CVE-2026-820902026-08-28Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bri…
CVE-2026-820892026-08-28The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
CVE-2026-77365High7.22026-08-28The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting v…
CVE-2026-76053High7.22026-08-28The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key I…
CVE-2026-3129Medium6.42026-08-28The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including…
CVE-2026-18978High7.22026-08-28The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to in…
CVE-2026-18324High7.22026-08-28The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare…
CVE-2026-16654Medium6.42026-08-28The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and includin…
CVE-2026-15798Medium6.42026-08-28The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.3…
CVE-2026-786162026-08-28A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execu…
CVE-2026-786152026-08-28A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authe…
CVE-2026-780472026-08-28A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inje…
CVE-2026-81731Medium5.42026-08-27Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is…
CVE-2026-663532026-08-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value…
CVE-2026-59316High8.22026-08-27Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker…
CVE-2026-59281Medium6.12026-08-27Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Er…
CVE-2026-535792026-08-27Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl…
CVE-2026-535782026-08-27Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl…
CVE-2026-489962026-08-27Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize…
CVE-2026-818202026-08-27Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; *…
CVE-2026-79720Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…
CVE-2026-79719Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…
CVE-2026-79718Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…