CWE-79 · Cross-site Scripting (page 20)
Page 20 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75048 | High | 8.2 | 2026-08-17 | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible |
CVE-2026-55674 | Critical | 9.3 | 2026-08-17 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request w… |
CVE-2026-13202 | | 2026-08-17 | A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2. | |
CVE-2026-74999 | Medium | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. |
CVE-2026-74998 | High | 7.2 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in inform… |
CVE-2026-40126 | | 2026-08-17 | OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a… | |
CVE-2026-74800 | Critical | 9.0 | 2026-08-17 | SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripti… |
CVE-2026-19998 | Medium | 4.3 | 2026-08-17 | A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulatio… |
CVE-2026-19995 | Low | 3.5 | 2026-08-17 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA… |
CVE-2026-2357 | Medium | 6.4 | 2026-08-16 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and… |
CVE-2026-13424 | High | 7.2 | 2026-08-16 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addo… |
CVE-2026-10734 | High | 7.2 | 2026-08-16 | The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.2… |
CVE-2026-19712 | Medium | 6.1 | 2026-08-16 | The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role… |
CVE-2026-18402 | Medium | 6.4 | 2026-08-16 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortc… |
CVE-2026-16775 | Medium | 6.4 | 2026-08-16 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Att… |
CVE-2026-16758 | Medium | 6.4 | 2026-08-16 | The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 d… |
CVE-2026-15790 | Medium | 6.4 | 2026-08-16 | The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode… |
CVE-2026-15604 | Medium | 6.4 | 2026-08-16 | The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post… |
CVE-2026-13712 | Medium | 5.4 | 2026-08-16 | The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allow… |
CVE-2026-15726 | Medium | 6.4 | 2026-08-16 | The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4… |
CVE-2026-15066 | Medium | 6.4 | 2026-08-16 | The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7… |
CVE-2026-15009 | Medium | 6.1 | 2026-08-16 | The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-15002 | High | 7.2 | 2026-08-16 | The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm… |
CVE-2026-12477 | Medium | 4.4 | 2026-08-16 | The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions u… |
CVE-2026-11780 | Medium | 6.4 | 2026-08-16 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parame… |
CVE-2026-2487 | Medium | 4.4 | 2026-08-16 | The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to… |
CVE-2026-19922 | Low | 3.5 | 2026-08-16 | A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php… |
CVE-2026-73053 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attack… |
CVE-2026-73052 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu… |
CVE-2026-73050 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight u… |
CVE-2026-73044 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attac… |
CVE-2026-73043 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and… |
CVE-2026-73042 | Critical | 9.0 | 2026-08-15 | SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, vie… |
CVE-2026-73041 | Critical | 9.0 | 2026-08-15 | SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious ma… |
CVE-2026-19916 | Low | 3.5 | 2026-08-15 | A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Perfor… |
CVE-2026-19904 | Low | 2.4 | 2026-08-15 | A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settin… |
CVE-2026-14230 | Medium | 5.4 | 2026-08-15 | The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability… |
CVE-2026-17090 | Medium | 6.4 | 2026-08-15 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (B… |
CVE-2026-16145 | High | 7.2 | 2026-08-15 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' para… |
CVE-2026-15948 | Medium | 6.4 | 2026-08-15 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter… |
CVE-2026-13360 | High | 7.2 | 2026-08-15 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in al… |
CVE-2026-14433 | High | 7.2 | 2026-08-15 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |
CVE-2026-17209 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. |
CVE-2026-63361 | | 2026-08-14 | LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name… | |
CVE-2026-53472 | Medium | 6.3 | 2026-08-14 | A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malic… |
CVE-2026-72832 | Medium | 5.4 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Secur… |
CVE-2026-72821 | Medium | 5.4 | 2026-08-14 | Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw… |
CVE-2026-19794 | High | 7.2 | 2026-08-14 | The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitizatio… |
CVE-2026-14290 | Medium | 6.8 | 2026-08-14 | The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowin… |
CVE-2026-18109 | High | 7.2 | 2026-08-14 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due t… |
CVE-2026-73428 | Medium | 4.6 | 2026-08-13 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted H… |
CVE-2026-73417 | | 2026-08-13 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6… | |
CVE-2026-56858 | Medium | 6.1 | 2026-08-13 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. |
CVE-2026-18741 | Medium | 4.8 | 2026-08-13 | Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administr… |
CVE-2026-73531 | Medium | 6.1 | 2026-08-13 | django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submi… |
CVE-2026-49864 | | 2026-08-13 | wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape seq… | |
CVE-2026-73650 | High | 8.2 | 2026-08-13 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and… |
CVE-2026-73038 | Medium | 6.1 | 2026-08-13 | NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes… |
CVE-2026-73037 | Medium | 6.1 | 2026-08-13 | Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping i… |
CVE-2026-73648 | | 2026-08-13 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG ref… | |
CVE-2026-73572 | Medium | 6.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient san… |
CVE-2026-19744 | | 2026-08-13 | Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application… | |
CVE-2026-28154 | High | 7.1 | 2026-08-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPres… |
CVE-2026-73357 | Medium | 6.5 | 2026-08-13 | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. |
CVE-2026-73344 | Medium | 5.9 | 2026-08-13 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
CVE-2026-73340 | Medium | 6.5 | 2026-08-13 | Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. |
CVE-2026-66700 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. |
CVE-2026-66698 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. |
CVE-2026-66697 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. |
CVE-2026-66687 | Medium | 6.5 | 2026-08-13 | Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. |
CVE-2026-66655 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. |
CVE-2026-66471 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. |
CVE-2026-66468 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. |
CVE-2026-66467 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions. |
CVE-2026-66460 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions. |
CVE-2026-66456 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions. |
CVE-2026-66449 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. |
CVE-2026-66429 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. |
CVE-2026-66426 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. |
CVE-2026-65580 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. |
CVE-2026-61974 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. |
CVE-2026-61965 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions. |
CVE-2026-61960 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. |
CVE-2026-28187 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions. |
CVE-2026-28182 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions. |
CVE-2026-28175 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. |
CVE-2026-28170 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions. |
CVE-2026-28158 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. |
CVE-2026-28004 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. |
CVE-2026-28003 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. |
CVE-2026-27539 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. |
CVE-2026-27537 | Medium | 6.5 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. |
CVE-2026-27536 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. |
CVE-2026-19716 | | 2026-08-13 | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary… | |
CVE-2026-73628 | Medium | 6.1 | 2026-08-13 | Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/fu… |
CVE-2026-3639 | Medium | 6.4 | 2026-08-13 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all version… |
CVE-2026-18146 | High | 7.2 | 2026-08-13 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-73492 | | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTM… | |
CVE-2026-73490 | Medium | 4.7 | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanit… |
CVE-2026-73427 | | 2026-08-12 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted applic… |