CWE-79 · Cross-site Scripting (page 2)
Page 2 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101158 | High | 8.4 | 2026-10-06 | A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site… |
CVE-2026-101157 | High | 8.7 | 2026-10-06 | A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes… |
CVE-2026-101156 | High | 8.4 | 2026-10-06 | A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The c… |
CVE-2026-106512 | | 2026-10-06 | The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied fi… | |
CVE-2026-106033 | Medium | 5.4 | 2026-10-06 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect rout… |
CVE-2026-104073 | High | 7.6 | 2026-10-06 | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" per… |
CVE-2026-106107 | | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths inte… | |
CVE-2026-106106 | | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, rende… | |
CVE-2026-106102 | Critical | 10.0 | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta… |
CVE-2026-105862 | High | 8.7 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that a… |
CVE-2026-105950 | Low | 3.5 | 2026-10-06 | A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formw… |
CVE-2026-105798 | High | 8.7 | 2026-10-06 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_d… |
CVE-2026-12380 | Medium | 6.1 | 2026-10-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce… |
CVE-2025-15591 | | 2026-10-06 | Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums w… | |
CVE-2026-94675 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. |
CVE-2026-42636 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. |
CVE-2026-42635 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. |
CVE-2026-42634 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. |
CVE-2026-42418 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected… |
CVE-2026-40807 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions. |
CVE-2026-40806 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions. |
CVE-2026-39790 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This… |
CVE-2026-39788 | Medium | 6.5 | 2026-10-06 | Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. |
CVE-2026-39784 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. |
CVE-2026-39781 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1.1 versions. |
CVE-2026-39780 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. |
CVE-2026-39778 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions. |
CVE-2026-39766 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
CVE-2026-39758 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. |
CVE-2026-39750 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6… |
CVE-2026-39748 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. |
CVE-2026-39745 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. |
CVE-2026-39731 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. |
CVE-2026-39727 | Medium | 6.5 | 2026-10-06 | Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. |
CVE-2026-39726 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions. |
CVE-2026-39724 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. |
CVE-2026-39722 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. |
CVE-2026-39720 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. |
CVE-2026-32577 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. |
CVE-2026-32575 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. |
CVE-2026-32574 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions. |
CVE-2026-32572 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. |
CVE-2026-32571 | Medium | 6.5 | 2026-10-06 | Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. |
CVE-2026-32570 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. |
CVE-2026-32569 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. |
CVE-2026-105879 | Medium | 6.5 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2026-105809 | Medium | 4.3 | 2026-10-06 | A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of… |
CVE-2026-105808 | Low | 3.5 | 2026-10-06 | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults… |
CVE-2026-105061 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. |
CVE-2026-104814 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. |
CVE-2026-104672 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. |
CVE-2026-104670 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. |
CVE-2026-104395 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. |
CVE-2026-104394 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. |
CVE-2026-103346 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway… |
CVE-2026-75962 | High | 7.2 | 2026-10-06 | The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored… |
CVE-2026-39760 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. |
CVE-2026-105708 | Medium | 4.3 | 2026-10-06 | A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the compone… |
CVE-2026-105705 | Medium | 4.3 | 2026-10-06 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performi… |
CVE-2026-105784 | Medium | 4.6 | 2026-10-06 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsonca… |
CVE-2026-105694 | Medium | 5.4 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, ev… |
CVE-2026-105679 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from… |
CVE-2026-105651 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an extern… |
CVE-2026-105650 | High | 8.1 | 2026-10-05 | Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts be… |
CVE-2026-105649 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored… |
CVE-2026-95166 | Medium | 5.4 | 2026-10-05 | In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload. |
CVE-2026-95165 | Medium | 6.1 | 2026-10-05 | Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. |
CVE-2026-105644 | Medium | 6.8 | 2026-10-05 | Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who… |
CVE-2026-105643 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-s… |
CVE-2026-100515 | High | 7.1 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-review… |
CVE-2026-100509 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows… |
CVE-2026-42700 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows S… |
CVE-2026-105630 | High | 8.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xm… |
CVE-2026-104979 | High | 8.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects… |
CVE-2026-102576 | Medium | 4.2 | 2026-10-05 | A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the app… |
CVE-2026-102295 | Medium | 5.4 | 2026-10-05 | A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript cod… |
CVE-2025-15643 | High | 7.1 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected… |
CVE-2026-105397 | Medium | 5.4 | 2026-10-05 | LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts vi… |
CVE-2026-102426 | | 2026-10-05 | Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum v… | |
CVE-2026-59788 | | 2026-10-05 | The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in… | |
CVE-2026-105291 | Medium | 4.3 | 2026-10-05 | A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/C… |
CVE-2026-105289 | Low | 3.5 | 2026-10-05 | A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model… |
CVE-2026-105288 | Medium | 4.3 | 2026-10-05 | A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP… |
CVE-2026-105069 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XS… |
CVE-2026-105060 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS… |
CVE-2026-105056 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-cat… |
CVE-2026-104808 | | 2026-10-05 | DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or H… | |
CVE-2026-104807 | | 2026-10-05 | DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or H… | |
CVE-2026-104673 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Son… |
CVE-2026-104409 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles… |
CVE-2026-104404 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This… |
CVE-2026-104400 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue a… |
CVE-2026-104396 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored… |
CVE-2026-103084 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-… |
CVE-2026-102914 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Store… |
CVE-2026-102393 | Medium | 6.5 | 2026-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Sto… |
CVE-2026-105188 | Low | 3.5 | 2026-10-05 | A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/… |
CVE-2026-105173 | Low | 3.5 | 2026-10-05 | A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventSt… |
CVE-2026-105220 | High | 7.8 | 2026-10-04 | Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor wi… |
CVE-2026-105224 | Medium | 5.4 | 2026-10-04 | YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped… |