CWE-79 · Cross-site Scripting (page 17)
Page 17 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5738 | Medium | 6.1 | 2026-08-27 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in BilPark Informatics Technologies Industry and Trade Inc… |
CVE-2026-11747 | Medium | 6.1 | 2026-08-27 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue af… |
CVE-2026-81814 | | 2026-08-27 | Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify… | |
CVE-2026-81753 | | 2026-08-27 | Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Merma… | |
CVE-2026-66155 | High | 7.6 | 2026-08-27 | A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All v… |
CVE-2026-78293 | High | 7.1 | 2026-08-27 | Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. |
CVE-2026-78289 | High | 7.1 | 2026-08-27 | Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. |
CVE-2026-78283 | High | 7.1 | 2026-08-27 | Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. |
CVE-2026-78281 | High | 7.1 | 2026-08-27 | Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. |
CVE-2026-78273 | Medium | 6.5 | 2026-08-27 | Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-78261 | High | 7.1 | 2026-08-27 | Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions. |
CVE-2026-78333 | High | 8.8 | 2026-08-27 | The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activ… |
CVE-2026-77989 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current req… | |
CVE-2026-47877 | High | 8.2 | 2026-08-27 | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security… |
CVE-2026-13416 | Low | 3.5 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Edi… |
CVE-2026-47666 | High | 7.6 | 2026-08-26 | Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through c… |
CVE-2026-47665 | High | 8.7 | 2026-08-26 | Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through f… |
CVE-2026-65930 | | 2026-08-26 | LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrat… | |
CVE-2026-63360 | | 2026-08-26 | LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint… | |
CVE-2026-45694 | Medium | 5.4 | 2026-08-26 | LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting t… |
CVE-2026-16809 | | 2026-08-26 | LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged… | |
CVE-2026-39275 | Medium | 6.1 | 2026-08-26 | Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and… |
CVE-2026-15973 | | 2026-08-26 | LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user w… | |
CVE-2026-32258 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with… |
CVE-2026-32257 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settin… |
CVE-2026-80426 | High | 7.1 | 2026-08-26 | FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.t… |
CVE-2026-54606 | | 2026-08-26 | SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/mo… | |
CVE-2026-5092 | Medium | 6.4 | 2026-08-26 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versio… |
CVE-2026-2388 | Medium | 6.4 | 2026-08-26 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is d… |
CVE-2026-6178 | Medium | 6.4 | 2026-08-26 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4… |
CVE-2026-3002 | Medium | 6.4 | 2026-08-26 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in… |
CVE-2026-18331 | High | 7.2 | 2026-08-26 | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-19760 | High | 7.2 | 2026-08-26 | The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and… |
CVE-2026-19226 | Medium | 6.8 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which… |
CVE-2026-55805 | Medium | 5.4 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects… |
CVE-2026-16640 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This… |
CVE-2026-16638 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affect… |
CVE-2026-15917 | Medium | 4.7 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-38473 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authent… |
CVE-2026-38472 | Medium | 6.1 | 2026-08-25 | A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to… |
CVE-2026-38469 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote aut… |
CVE-2026-38466 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-38465 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-79793 | Medium | 4.3 | 2026-08-25 | A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit… |
CVE-2026-74932 | High | 7.5 | 2026-08-25 | The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the page… |
CVE-2026-26211 | Medium | 4.8 | 2026-08-25 | Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in th… |
CVE-2026-79663 | Medium | 4.8 | 2026-08-25 | Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML es… |
CVE-2026-77996 | | 2026-08-25 | Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a X… | |
CVE-2026-18547 | Medium | 6.4 | 2026-08-25 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-76128 | Medium | 6.4 | 2026-08-25 | The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and incl… |
CVE-2026-16231 | High | 8.1 | 2026-08-25 | hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaqu… |
CVE-2026-66882 | | 2026-08-25 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the… | |
CVE-2026-18512 | Medium | 6.4 | 2026-08-25 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Bo… |
CVE-2026-18328 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the… |
CVE-2026-18323 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save… |
CVE-2026-18100 | Medium | 6.4 | 2026-08-25 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id… |
CVE-2026-12561 | Medium | 6.4 | 2026-08-25 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5… |
CVE-2026-76063 | Medium | 6.4 | 2026-08-25 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' paramete… |
CVE-2026-19943 | Medium | 6.4 | 2026-08-25 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute… |
CVE-2026-17089 | Medium | 6.1 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parame… |
CVE-2026-75019 | Medium | 6.4 | 2026-08-25 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2025-9878 | Medium | 6.4 | 2026-08-25 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp… |
CVE-2026-56704 | Medium | 6.1 | 2026-08-25 | Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controllin… |
CVE-2026-78282 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions. |
CVE-2026-78264 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions. |
CVE-2026-78263 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions. |
CVE-2026-32556 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions. |
CVE-2022-30983 | Medium | 6.1 | 2026-08-24 | A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web s… |
CVE-2026-71503 | Medium | 6.1 | 2026-08-24 | Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is… |
CVE-2026-30864 | High | 8.9 | 2026-08-24 | Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert func… |
CVE-2026-76837 | Medium | 6.4 | 2026-08-24 | Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbat… |
CVE-2026-34491 | | 2026-08-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys… | |
CVE-2026-78414 | High | 8.0 | 2026-08-24 | Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-ne… |
CVE-2026-78391 | | 2026-08-24 | RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names o… | |
CVE-2026-65053 | Medium | 6.1 | 2026-08-24 | Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble… |
CVE-2026-17033 | Medium | 6.8 | 2026-08-24 | An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL… |
CVE-2026-78290 | Medium | 6.5 | 2026-08-24 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions. |
CVE-2026-66623 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions. |
CVE-2026-66610 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions. |
CVE-2026-66599 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions. |
CVE-2026-66584 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions. |
CVE-2026-32476 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions. |
CVE-2026-28166 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions. |
CVE-2026-28162 | High | 7.1 | 2026-08-24 | Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions. |
CVE-2026-10618 | Medium | 5.4 | 2026-08-24 | Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in ma… |
CVE-2026-77993 | | 2026-08-24 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscon… | |
CVE-2026-78187 | Low | 3.1 | 2026-08-24 | A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argumen… |
CVE-2026-78213 | High | 8.7 | 2026-08-24 | Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious co… |
CVE-2026-8630 | Medium | 6.1 | 2026-08-23 | justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <st… |
CVE-2026-8445 | Critical | 9.8 | 2026-08-23 | justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed do… |
CVE-2026-77088 | Medium | 6.1 | 2026-08-23 | justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as… |
CVE-2026-74793 | Medium | 6.1 | 2026-08-23 | justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections… |
CVE-2026-6827 | Medium | 6.1 | 2026-08-23 | justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign n… |
CVE-2026-5751 | Medium | 6.1 | 2026-08-23 | justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy… |
CVE-2026-77115 | High | 7.1 | 2026-08-23 | Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them. |
CVE-2026-78060 | Medium | 4.3 | 2026-08-23 | A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php… |
CVE-2026-78059 | Medium | 4.3 | 2026-08-23 | A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php_action/printOrder.php. S… |
CVE-2026-78055 | Medium | 4.3 | 2026-08-23 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-78054 | Medium | 4.3 | 2026-08-23 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a man… |
CVE-2026-77027 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an store… |