CWE-79 · Cross-site Scripting (page 18)
Page 18 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77027 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an store… | |
CVE-2026-4561 | Medium | 6.4 | 2026-08-22 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'tex… |
CVE-2026-4559 | Medium | 6.4 | 2026-08-22 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions… |
CVE-2026-66917 | | 2026-08-22 | Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS e… | |
CVE-2026-76789 | High | 8.8 | 2026-08-22 | The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and… |
CVE-2026-16260 | Medium | 6.8 | 2026-08-22 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it… |
CVE-2026-53529 | | 2026-08-21 | LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with edit… | |
CVE-2026-53468 | Medium | 4.6 | 2026-08-21 | Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to… |
CVE-2026-43980 | Medium | 6.3 | 2026-08-21 | Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name… |
CVE-2026-33240 | High | 8.8 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key searc… |
CVE-2026-77811 | High | 8.7 | 2026-08-21 | Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSear… |
CVE-2026-69238 | Low | 3.5 | 2026-08-21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary… |
CVE-2026-69237 | Low | 3.8 | 2026-08-21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to inse… |
CVE-2026-69236 | Medium | 6.1 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious… |
CVE-2026-69235 | Medium | 6.1 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious… |
CVE-2026-69234 | Medium | 6.1 | 2026-08-21 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to… |
CVE-2026-69233 | Medium | 5.5 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to… |
CVE-2026-69232 | Medium | 5.5 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious… |
CVE-2026-69231 | Medium | 5.5 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious… |
CVE-2026-69230 | Medium | 5.5 | 2026-08-21 | There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to… |
CVE-2026-69229 | Medium | 5.4 | 2026-08-21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTM… |
CVE-2026-63135 | High | 8.2 | 2026-08-21 | YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(… |
CVE-2026-61824 | High | 8.2 | 2026-08-21 | Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into… |
CVE-2026-31880 | High | 8.0 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search… |
CVE-2026-31803 | High | 8.0 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin… |
CVE-2026-30890 | High | 8.0 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import scr… |
CVE-2026-30865 | High | 7.1 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save fun… |
CVE-2026-30826 | High | 8.0 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query… |
CVE-2026-74252 | | 2026-08-21 | Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored… | |
CVE-2026-50290 | | 2026-08-21 | SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` u… | |
CVE-2026-30819 | High | 7.3 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert f… |
CVE-2026-55850 | | 2026-08-21 | Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx rend… | |
CVE-2026-54682 | High | 8.2 | 2026-08-21 | DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled conte… |
CVE-2026-54681 | Medium | 4.1 | 2026-08-21 | DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs… |
CVE-2026-75933 | High | 7.3 | 2026-08-21 | Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of… |
CVE-2026-77028 | | 2026-08-21 | Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66 | |
CVE-2026-76612 | | 2026-08-21 | Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied fie… | |
CVE-2026-73537 | Medium | 4.7 | 2026-08-21 | Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser compon… |
CVE-2026-14325 | Low | 3.5 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag na… |
CVE-2026-65644 | High | 7.5 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that a… |
CVE-2026-18409 | High | 7.2 | 2026-08-21 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, a… |
CVE-2026-77643 | Medium | 4.4 | 2026-08-20 | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HT… |
CVE-2026-55491 | Medium | 5.4 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/inde… |
CVE-2026-54505 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into j… | |
CVE-2026-49436 | High | 7.3 | 2026-08-20 | LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without… |
CVE-2026-49245 | Low | 3.7 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authent… |
CVE-2026-77506 | Medium | 4.8 | 2026-08-20 | Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. |
CVE-2026-68921 | Medium | 4.7 | 2026-08-20 | DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute witho… |
CVE-2026-75526 | Medium | 4.4 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_plac… |
CVE-2026-50190 | | 2026-08-20 | Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListControlle… | |
CVE-2026-73259 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using… |
CVE-2026-73254 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cr… |
CVE-2026-49825 | High | 8.2 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:hre… |
CVE-2026-64972 | | 2026-08-20 | ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break o… | |
CVE-2026-64971 | | 2026-08-20 | ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScr… | |
CVE-2026-64970 | | 2026-08-20 | ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in th… | |
CVE-2026-77072 | High | 7.6 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied it… |
CVE-2026-73402 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. |
CVE-2026-68564 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. |
CVE-2026-66673 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. |
CVE-2026-66616 | High | 7.1 | 2026-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.Th… |
CVE-2026-66615 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions. |
CVE-2026-66614 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions. |
CVE-2026-66612 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions. |
CVE-2026-66611 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions. |
CVE-2026-66607 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions. |
CVE-2026-66606 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. |
CVE-2026-66605 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions. |
CVE-2026-66604 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions. |
CVE-2026-66601 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66598 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. |
CVE-2026-66597 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions. |
CVE-2026-66590 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. |
CVE-2026-66582 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. |
CVE-2026-66581 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. |
CVE-2026-76569 | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4 | |
CVE-2026-76565 | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 | |
CVE-2026-76564 | | 2026-08-20 | Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 | |
CVE-2026-75948 | | 2026-08-20 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fie… | |
CVE-2026-71368 | Medium | 6.1 | 2026-08-20 | F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be p… |
CVE-2026-74992 | Medium | 6.8 | 2026-08-20 | The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove… |
CVE-2026-19697 | Medium | 6.8 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload cap… |
CVE-2026-19615 | Medium | 6.8 | 2026-08-20 | The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users… |
CVE-2026-76367 | Medium | 4.0 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of a… |
CVE-2026-76346 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sp… |
CVE-2026-76333 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action… |
CVE-2026-76326 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard vi… |
CVE-2026-76325 | High | 7.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge obje… |
CVE-2026-76324 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and c… |
CVE-2026-76318 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious sc… |
CVE-2026-76252 | Medium | 6.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page coul… |
CVE-2026-54743 | | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post… | |
CVE-2026-68900 | High | 7.6 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textCo… |
CVE-2026-67189 | Medium | 6.1 | 2026-08-19 | pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR… |
CVE-2026-55090 | | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditiona… | |
CVE-2026-55087 | Medium | 6.1 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/expre… |
CVE-2026-55085 | Critical | 9.6 | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list… |
CVE-2026-61807 | Medium | 6.1 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-sele… |
CVE-2026-64851 | | 2026-08-19 | Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav S… | |
CVE-2026-61607 | Medium | 4.6 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media… |