CWE-79 · Cross-site Scripting (page 19)
Page 19 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18430 | | 2026-08-19 | HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's c… | |
CVE-2026-75955 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XM… | |
CVE-2026-54793 | Medium | 4.6 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabi… |
CVE-2026-40508 | Medium | 5.4 | 2026-08-19 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers wit… |
CVE-2026-40507 | Medium | 6.1 | 2026-08-19 | OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is r… |
CVE-2026-18756 | | 2026-08-19 | HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacke… | |
CVE-2026-18526 | | 2026-08-19 | HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow. | |
CVE-2026-75917 | High | 8.6 | 2026-08-19 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/move… |
CVE-2026-75916 | High | 8.6 | 2026-08-19 | SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/h… |
CVE-2026-73354 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions. |
CVE-2026-73184 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions. |
CVE-2026-73182 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions. |
CVE-2026-66596 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions. |
CVE-2026-61986 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions. |
CVE-2026-18372 | | 2026-08-19 | CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user inte… | |
CVE-2026-18371 | | 2026-08-19 | HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users. | |
CVE-2026-75981 | High | 7.2 | 2026-08-19 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in vers… |
CVE-2026-15780 | High | 7.2 | 2026-08-19 | The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campai… |
CVE-2026-15446 | Medium | 6.4 | 2026-08-19 | The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all version… |
CVE-2026-19056 | High | 7.1 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its adm… |
CVE-2026-19055 | High | 7.1 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its pub… |
CVE-2026-18202 | Medium | 6.8 | 2026-08-19 | The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with t… |
CVE-2026-16617 | High | 8.8 | 2026-08-19 | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, a… |
CVE-2026-16570 | High | 7.1 | 2026-08-19 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its a… |
CVE-2026-15253 | Medium | 6.8 | 2026-08-19 | The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media l… |
CVE-2026-14334 | High | 8.8 | 2026-08-19 | The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attack… |
CVE-2026-14287 | Medium | 4.7 | 2026-08-19 | The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacke… |
CVE-2026-66358 | Medium | 6.1 | 2026-08-19 | A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script. |
CVE-2026-15421 | Medium | 6.4 | 2026-08-19 | The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in… |
CVE-2026-66591 | Medium | 6.5 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. … |
CVE-2026-27365 | Medium | 5.9 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This… |
CVE-2026-66603 | Medium | 6.5 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored X… |
CVE-2026-52873 | Medium | 6.9 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC han… |
CVE-2026-52854 | High | 8.6 | 2026-08-18 | Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser func… |
CVE-2026-21580 | | 2026-08-18 | This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0… | |
CVE-2026-54347 | High | 8.7 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain… |
CVE-2026-41921 | Medium | 5.4 | 2026-08-18 | Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated… |
CVE-2025-9211 | Medium | 6.7 | 2026-08-18 | Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalat… |
CVE-2026-61696 | Medium | 6.3 | 2026-08-18 | Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through… |
CVE-2026-52609 | Medium | 6.1 | 2026-08-18 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a… |
CVE-2026-73336 | Medium | 6.4 | 2026-08-18 | Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org mar… |
CVE-2026-52606 | Medium | 6.1 | 2026-08-18 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a… |
CVE-2026-30250 | Medium | 6.1 | 2026-08-18 | Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute ar… |
CVE-2026-55839 | High | 8.7 | 2026-08-18 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows… |
CVE-2026-45116 | High | 8.7 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, res… |
CVE-2026-45115 | High | 8.7 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform J… |
CVE-2026-73426 | Medium | 4.6 | 2026-08-18 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-seri… |
CVE-2026-73393 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. |
CVE-2026-73382 | High | 7.1 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.T… |
CVE-2026-73378 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. |
CVE-2026-73375 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. |
CVE-2026-73362 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions. |
CVE-2026-73361 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions. |
CVE-2026-73360 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. |
CVE-2026-73359 | Medium | 6.5 | 2026-08-18 | Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions. |
CVE-2026-73358 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. |
CVE-2026-73351 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions. |
CVE-2026-73342 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. |
CVE-2026-73338 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. |
CVE-2026-73190 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions. |
CVE-2026-68567 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions. |
CVE-2026-68565 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. |
CVE-2026-66667 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions. |
CVE-2026-66646 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions. |
CVE-2026-66645 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions. |
CVE-2026-66644 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions. |
CVE-2026-66643 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions. |
CVE-2026-66641 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions. |
CVE-2026-66640 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions. |
CVE-2026-66639 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions. |
CVE-2026-66638 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66637 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66636 | Medium | 6.5 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue a… |
CVE-2026-66633 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. |
CVE-2026-66629 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions. |
CVE-2026-66621 | High | 7.1 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashbo… |
CVE-2026-45733 | High | 8.3 | 2026-08-18 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass la… |
CVE-2026-32547 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions. |
CVE-2026-32333 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions. |
CVE-2026-28569 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. |
CVE-2026-28568 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions. |
CVE-2026-75838 | | 2026-08-18 | DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees… | |
CVE-2026-75834 | Medium | 5.4 | 2026-08-18 | Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS de… |
CVE-2026-75831 | High | 7.6 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The m… |
CVE-2026-75828 | High | 8.7 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass e… |
CVE-2026-75107 | Medium | 5.4 | 2026-08-18 | Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in fo… |
CVE-2026-74908 | Medium | 4.6 | 2026-08-18 | Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and… |
CVE-2026-74902 | High | 8.6 | 2026-08-18 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into… |
CVE-2026-75626 | Critical | 9.3 | 2026-08-18 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious… |
CVE-2026-19447 | Medium | 5.4 | 2026-08-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allow… |
CVE-2026-75091 | High | 7.2 | 2026-08-18 | The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, a… |
CVE-2026-75078 | Medium | 4.3 | 2026-08-17 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a… |
CVE-2026-75077 | Medium | 4.3 | 2026-08-17 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2… |
CVE-2026-75531 | | 2026-08-17 | Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed fil… | |
CVE-2026-75529 | | 2026-08-17 | Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies th… | |
CVE-2026-67925 | Medium | 6.1 | 2026-08-17 | Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload |
CVE-2026-63670 | Medium | 6.1 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanit… |
CVE-2026-50771 | Medium | 6.1 | 2026-08-17 | Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create E… |
CVE-2026-33437 | High | 8.1 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/r… |
CVE-2026-75059 | Medium | 4.4 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible |