CWE-79 · Cross-site Scripting (page 2)
Page 2 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30250 | Medium | 6.1 | 2026-08-18 | Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute ar… |
CVE-2026-55839 | High | 8.7 | 2026-08-18 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows… |
CVE-2026-45116 | High | 8.7 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, res… |
CVE-2026-45115 | High | 8.7 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform J… |
CVE-2026-73426 | Medium | 4.6 | 2026-08-18 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-seri… |
CVE-2026-73393 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. |
CVE-2026-73382 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions. |
CVE-2026-73378 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. |
CVE-2026-73375 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. |
CVE-2026-73362 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions. |
CVE-2026-73361 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions. |
CVE-2026-73360 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. |
CVE-2026-73359 | Medium | 6.5 | 2026-08-18 | Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions. |
CVE-2026-73358 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. |
CVE-2026-73351 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions. |
CVE-2026-73342 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. |
CVE-2026-73338 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. |
CVE-2026-73190 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions. |
CVE-2026-68567 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions. |
CVE-2026-68565 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. |
CVE-2026-66667 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions. |
CVE-2026-66646 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions. |
CVE-2026-66645 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions. |
CVE-2026-66644 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions. |
CVE-2026-66643 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions. |
CVE-2026-66641 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions. |
CVE-2026-66640 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions. |
CVE-2026-66639 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions. |
CVE-2026-66638 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66637 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66636 | Medium | 6.5 | 2026-08-18 | Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions. |
CVE-2026-66633 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. |
CVE-2026-66629 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions. |
CVE-2026-66621 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions. |
CVE-2026-45733 | High | 8.3 | 2026-08-18 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass la… |
CVE-2026-32547 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions. |
CVE-2026-32333 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions. |
CVE-2026-28569 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. |
CVE-2026-28568 | High | 7.1 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions. |
CVE-2026-75838 | | 2026-08-18 | DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees… | |
CVE-2026-75834 | Medium | 5.4 | 2026-08-18 | Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS de… |
CVE-2026-75831 | High | 7.6 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The m… |
CVE-2026-75828 | High | 8.7 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass e… |
CVE-2026-75107 | Medium | 5.4 | 2026-08-18 | Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in fo… |
CVE-2026-74908 | Medium | 4.6 | 2026-08-18 | Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and… |
CVE-2026-74902 | High | 8.6 | 2026-08-18 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into… |
CVE-2026-75626 | Critical | 9.3 | 2026-08-18 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious… |
CVE-2026-19447 | Medium | 5.4 | 2026-08-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allow… |
CVE-2026-75091 | High | 7.2 | 2026-08-18 | The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, a… |
CVE-2026-75078 | Medium | 4.3 | 2026-08-17 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a… |
CVE-2026-75077 | Medium | 4.3 | 2026-08-17 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2… |
CVE-2026-75531 | | 2026-08-17 | Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed fil… | |
CVE-2026-75529 | | 2026-08-17 | Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies th… | |
CVE-2026-67925 | Medium | 6.1 | 2026-08-17 | Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload |
CVE-2026-63670 | Medium | 6.1 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanit… |
CVE-2026-50771 | Medium | 6.1 | 2026-08-17 | Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create E… |
CVE-2026-33437 | High | 8.1 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/r… |
CVE-2026-75059 | Medium | 4.4 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible |
CVE-2026-75048 | High | 8.2 | 2026-08-17 | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible |
CVE-2026-55674 | Critical | 9.3 | 2026-08-17 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request w… |
CVE-2026-13202 | | 2026-08-17 | A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2. | |
CVE-2026-74999 | Medium | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. |
CVE-2026-74998 | High | 7.2 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in inform… |
CVE-2026-40126 | | 2026-08-17 | OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a… | |
CVE-2026-74800 | Critical | 9.0 | 2026-08-17 | SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripti… |
CVE-2026-19998 | Medium | 4.3 | 2026-08-17 | A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulatio… |
CVE-2026-19995 | Low | 3.5 | 2026-08-17 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA… |
CVE-2026-2357 | Medium | 6.4 | 2026-08-16 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and… |
CVE-2026-13424 | High | 7.2 | 2026-08-16 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addo… |
CVE-2026-10734 | High | 7.2 | 2026-08-16 | The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.2… |
CVE-2026-19712 | Medium | 6.1 | 2026-08-16 | The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role… |
CVE-2026-18402 | Medium | 6.4 | 2026-08-16 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortc… |
CVE-2026-16775 | Medium | 6.4 | 2026-08-16 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Att… |
CVE-2026-16758 | Medium | 6.4 | 2026-08-16 | The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 d… |
CVE-2026-15790 | Medium | 6.4 | 2026-08-16 | The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode… |
CVE-2026-15604 | Medium | 6.4 | 2026-08-16 | The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post… |
CVE-2026-13712 | Medium | 5.4 | 2026-08-16 | The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allow… |
CVE-2026-15726 | Medium | 6.4 | 2026-08-16 | The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4… |
CVE-2026-15066 | Medium | 6.4 | 2026-08-16 | The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7… |
CVE-2026-15009 | Medium | 6.1 | 2026-08-16 | The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-15002 | High | 7.2 | 2026-08-16 | The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm… |
CVE-2026-12477 | Medium | 4.4 | 2026-08-16 | The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions u… |
CVE-2026-11780 | Medium | 6.4 | 2026-08-16 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parame… |
CVE-2026-2487 | Medium | 4.4 | 2026-08-16 | The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to… |
CVE-2026-19922 | Low | 3.5 | 2026-08-16 | A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php… |
CVE-2026-73053 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attack… |
CVE-2026-73052 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu… |
CVE-2026-73050 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight u… |
CVE-2026-73044 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attac… |
CVE-2026-73043 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and… |
CVE-2026-73042 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie… |
CVE-2026-73041 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma… |
CVE-2026-19916 | Low | 3.5 | 2026-08-15 | A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Perfor… |
CVE-2026-19904 | Low | 2.4 | 2026-08-15 | A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settin… |
CVE-2026-14230 | Medium | 5.4 | 2026-08-15 | The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability… |
CVE-2026-17090 | Medium | 6.4 | 2026-08-15 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (B… |
CVE-2026-16145 | High | 7.2 | 2026-08-15 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' para… |
CVE-2026-15948 | Medium | 6.4 | 2026-08-15 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter… |
CVE-2026-13360 | High | 7.2 | 2026-08-15 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in al… |
CVE-2026-14433 | High | 7.2 | 2026-08-15 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |