CWE-79 · Cross-site Scripting (page 17)
Page 17 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-20066 | High | 7.2 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file up… |
CVE-2026-12202 | Low | 2.4 | 2026-06-15 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. S… |
CVE-2026-12176 | Medium | 4.3 | 2026-06-14 | A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impacted element is an unknown function of… |
CVE-2026-5513 | High | 7.2 | 2026-06-13 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-n… |
CVE-2026-9629 | Medium | 6.4 | 2026-06-13 | The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insuffi… |
CVE-2026-3297 | Medium | 6.4 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions… |
CVE-2026-9134 | Medium | 6.4 | 2026-06-13 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and incl… |
CVE-2026-9109 | High | 7.2 | 2026-06-13 | The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-9061 | Low | 3.5 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordP… |
CVE-2026-11443 | Medium | 4.6 | 2026-06-13 | Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to execute arbitrary script on… |
CVE-2026-53608 | High | 8.7 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google An… |
CVE-2026-54395 | | 2026-06-12 | MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler… | |
CVE-2026-54393 | | 2026-06-12 | A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path… | |
CVE-2026-53606 | Medium | 5.4 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-ht… |
CVE-2026-45014 | | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsani… | |
CVE-2026-45011 | High | 7.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functiona… |
CVE-2026-44990 | Critical | 9.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default confi… |
CVE-2026-12130 | Low | 3.5 | 2026-06-12 | A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the c… |
CVE-2026-12129 | Low | 3.5 | 2026-06-12 | A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/a… |
CVE-2026-53724 | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default… | |
CVE-2026-53568 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This i… | |
CVE-2026-53722 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to… |
CVE-2026-47739 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This iss… | |
CVE-2026-44205 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to… | |
CVE-2026-46342 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server v… |
CVE-2026-9125 | Medium | 6.4 | 2026-06-12 | The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in ve… |
CVE-2026-42653 | High | 7.1 | 2026-06-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects… |
CVE-2026-46489 | High | 8.1 | 2026-06-11 | SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authen… |
CVE-2026-8589 | High | 7.3 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-10087 | High | 8.7 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain co… |
CVE-2023-33999 | High | 7.1 | 2026-06-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue aff… |
CVE-2026-40986 | Medium | 4.8 | 2026-06-11 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scr… |
CVE-2026-2827 | Medium | 4.7 | 2026-06-11 | The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and in… |
CVE-2026-42558 | High | 7.6 | 2026-06-10 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain… |
CVE-2026-53742 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contr… |
CVE-2026-53741 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field… |
CVE-2026-53740 | Medium | 5.4 | 2026-06-10 | Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a rep… |
CVE-2026-53737 | Medium | 6.1 | 2026-06-10 | Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected fe… |
CVE-2026-0266 | Medium | 4.8 | 2026-06-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload… |
CVE-2026-45106 | Medium | 4.6 | 2026-06-10 | Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any… |
CVE-2026-46642 | Medium | 6.1 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the e… |
CVE-2026-20258 | High | 7.1 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-46609 | Medium | 4.6 | 2026-06-10 | Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in… |
CVE-2026-53693 | | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection… | |
CVE-2026-53473 | High | 7.3 | 2026-06-10 | A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript… |
CVE-2026-45560 | Medium | 6.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wrap_line (app/modules/common/common.py:1… |
CVE-2026-53441 | Medium | 5.4 | 2026-06-10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline c… |
CVE-2026-49069 | High | 7.1 | 2026-06-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affect… |
CVE-2026-9019 | Medium | 6.4 | 2026-06-10 | The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_ur… |
CVE-2026-8853 | Medium | 4.4 | 2026-06-10 | The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to in… |
CVE-2026-8613 | Medium | 6.4 | 2026-06-10 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and in… |
CVE-2026-9060 | Low | 3.5 | 2026-06-10 | The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordP… |
CVE-2026-8071 | High | 8.8 | 2026-06-10 | The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encodin… |
CVE-2025-8444 | Medium | 6.4 | 2026-06-10 | The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Script… |
CVE-2026-46546 | Medium | 5.4 | 2026-06-10 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could sup… |
CVE-2026-46518 | High | 7.7 | 2026-06-10 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scriptin… |
CVE-2026-41003 | High | 7.6 | 2026-06-10 | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affecte… |
CVE-2026-34417 | Medium | 6.1 | 2026-06-09 | OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser b… |
CVE-2026-25860 | Medium | 6.1 | 2026-06-09 | OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary Jav… |
CVE-2026-47933 | Medium | 4.8 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged atta… |
CVE-2026-34416 | Medium | 6.1 | 2026-06-09 | OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser b… |
CVE-2026-25557 | Medium | 5.4 | 2026-06-09 | Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is refle… |
CVE-2026-11799 | High | 7.5 | 2026-06-09 | UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. |
CVE-2026-47106 | Medium | 5.4 | 2026-06-09 | Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality t… |
CVE-2026-32856 | Medium | 6.1 | 2026-06-09 | Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attac… |
CVE-2026-36728 | Medium | 5.4 | 2026-06-09 | A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web sc… |
CVE-2026-36725 | Medium | 6.1 | 2026-06-09 | A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to execute arbitrary we… |
CVE-2026-34694 | Medium | 4.8 | 2026-06-09 | Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abuse… |
CVE-2026-34693 | High | 8.0 | 2026-06-09 | Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker cou… |
CVE-2026-34691 | Critical | 9.3 | 2026-06-09 | Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abuse… |
CVE-2026-48562 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-48560 | Medium | 5.4 | 2026-06-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-48304 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-48301 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-48300 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-48299 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-48297 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-48280 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48271 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48268 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48266 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48265 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48264 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48258 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48256 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48251 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-48250 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47993 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47990 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-47989 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47987 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47986 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47985 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47983 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47982 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-47981 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-47980 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-47978 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-47977 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |
CVE-2026-47975 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused b… |