CWE-79 · Cross-site Scripting (page 21)
Page 21 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8898 | Medium | 6.4 | 2026-05-27 | The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This… |
CVE-2026-8897 | Medium | 6.4 | 2026-05-27 | The Shortcode Buddy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 0.1.9.5 du… |
CVE-2026-8894 | Medium | 6.4 | 2026-05-27 | The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to, and including, 1.0… |
CVE-2026-8891 | Medium | 6.4 | 2026-05-27 | The BitForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bitform' shortcode in versions up to, and including, 1.1.0. Thi… |
CVE-2026-8887 | Medium | 6.4 | 2026-05-27 | The Listen Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'listen' shortcode in versions up to, and including, 1.0. This i… |
CVE-2026-8886 | Medium | 6.4 | 2026-05-27 | The hk_shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This… |
CVE-2026-8884 | Medium | 6.4 | 2026-05-27 | The Instant-Quote.co Quotation Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and inclu… |
CVE-2026-8877 | Medium | 6.4 | 2026-05-27 | The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up to, and including… |
CVE-2026-8875 | Medium | 6.4 | 2026-05-27 | The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' (and 'c') shortcode in versions up… |
CVE-2026-8873 | Medium | 6.4 | 2026-05-27 | The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 du… |
CVE-2026-8872 | Medium | 6.4 | 2026-05-27 | The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and in… |
CVE-2026-8871 | Medium | 6.4 | 2026-05-27 | The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic_link' shortcode in versions up to, and including, 1.1… |
CVE-2026-8870 | Medium | 6.4 | 2026-05-27 | The Team Master – A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions u… |
CVE-2026-8869 | Medium | 6.4 | 2026-05-27 | The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up to, and including, 1… |
CVE-2026-8868 | Medium | 6.4 | 2026-05-27 | The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and includin… |
CVE-2026-8867 | Medium | 6.4 | 2026-05-27 | The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to… |
CVE-2026-8866 | Medium | 6.4 | 2026-05-27 | The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including… |
CVE-2026-8847 | Medium | 6.4 | 2026-05-27 | The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient inpu… |
CVE-2026-8846 | Medium | 6.4 | 2026-05-27 | The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'TUXQUOTE' shortcode in versions up to, and including, 1.3. This is due… |
CVE-2026-8845 | Medium | 6.4 | 2026-05-27 | The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1… |
CVE-2026-8844 | Medium | 6.4 | 2026-05-27 | The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. Th… |
CVE-2026-8842 | Medium | 6.4 | 2026-05-27 | The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcode in versions up to, and including, 1.0… |
CVE-2026-8837 | Medium | 6.4 | 2026-05-27 | The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adid' Shortcode Attribute in all versions… |
CVE-2026-8707 | Medium | 6.1 | 2026-05-27 | The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to… |
CVE-2026-8703 | Medium | 6.4 | 2026-05-27 | The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due t… |
CVE-2026-8702 | Medium | 6.4 | 2026-05-27 | The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This i… |
CVE-2026-8701 | Medium | 6.4 | 2026-05-27 | The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `title-ticker-slide`, `title-ticker-fade`… |
CVE-2026-8698 | Medium | 6.4 | 2026-05-27 | The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient outpu… |
CVE-2026-8048 | Medium | 6.4 | 2026-05-27 | The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in a… |
CVE-2026-8040 | Medium | 6.4 | 2026-05-27 | The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions… |
CVE-2026-6268 | High | 7.1 | 2026-05-27 | The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler befor… |
CVE-2026-6287 | Medium | 5.4 | 2026-05-27 | The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block at… |
CVE-2026-9022 | Medium | 6.4 | 2026-05-27 | The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7… |
CVE-2026-48999 | Medium | 5.7 | 2026-05-27 | Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious c… |
CVE-2026-9608 | Low | 2.4 | 2026-05-27 | A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator… |
CVE-2026-6565 | Medium | 6.4 | 2026-05-27 | The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-44903 | Medium | 6.1 | 2026-05-26 | Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enab… |
CVE-2026-44899 | Medium | 4.7 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a re… |
CVE-2026-44898 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id… |
CVE-2026-44897 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the… |
CVE-2026-44896 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concaten… |
CVE-2026-44708 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by… |
CVE-2026-36239 | Medium | 4.3 | 2026-05-26 | PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality |
CVE-2026-44831 | Medium | 4.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting i… |
CVE-2025-68709 | Medium | 5.2 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which a… |
CVE-2026-9566 | Medium | 4.3 | 2026-05-26 | A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.t… |
CVE-2026-44669 | High | 8.7 | 2026-05-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachmen… |
CVE-2026-44667 | High | 8.7 | 2026-05-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachmen… |
CVE-2026-9564 | Low | 2.4 | 2026-05-26 | A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file… |
CVE-2026-48905 | Medium | 6.1 | 2026-05-26 | Lack of input filtering leads to an XSS vector in the HTML filter code. |
CVE-2026-48903 | Medium | 6.1 | 2026-05-26 | Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. |
CVE-2026-44729 | High | 8.7 | 2026-05-26 | Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using… |
CVE-2026-30895 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the readmore links for com_content. |
CVE-2026-30894 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the content history component. |
CVE-2026-25901 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the multilingual associations component. |
CVE-2026-25900 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the feed modules. |
CVE-2025-36148 | Medium | 5.4 | 2026-05-26 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross… |
CVE-2025-36126 | Medium | 6.4 | 2026-05-26 | IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos… |
CVE-2026-27427 | Medium | 6.5 | 2026-05-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affe… |
CVE-2026-9527 | Medium | 4.3 | 2026-05-26 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This ma… |
CVE-2026-9520 | Medium | 4.3 | 2026-05-26 | A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/a… |
CVE-2026-9519 | Medium | 4.3 | 2026-05-26 | A security flaw has been discovered in stonith404 pingvin-share up to 1.13.0. This affects the function getServerSideProps of the file frontend/src/pages/auth/… |
CVE-2026-9518 | Medium | 4.3 | 2026-05-26 | A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file view_students.php… |
CVE-2026-45435 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This iss… |
CVE-2025-62745 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue… |
CVE-2026-9485 | Low | 3.5 | 2026-05-25 | A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file student… |
CVE-2026-48849 | Medium | 4.4 | 2026-05-25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS inj… |
CVE-2026-48848 | High | 7.2 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an… |
CVE-2026-9471 | Low | 3.5 | 2026-05-25 | A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file… |
CVE-2026-9448 | Medium | 4.3 | 2026-05-25 | A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manip… |
CVE-2026-45249 | Medium | 6.1 | 2026-05-25 | A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apache ECharts: from be… |
CVE-2026-9419 | Medium | 4.3 | 2026-05-25 | A vulnerability has been found in code-projects Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /empproject.ph… |
CVE-2026-9418 | Medium | 4.3 | 2026-05-25 | A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.ph… |
CVE-2026-9417 | Medium | 4.3 | 2026-05-25 | A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. Performing a manipu… |
CVE-2026-6059 | | 2026-05-25 | A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via… | |
CVE-2026-9416 | Medium | 4.3 | 2026-05-25 | A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such m… |
CVE-2026-9415 | Medium | 4.3 | 2026-05-25 | A weakness has been identified in code-projects Employee Management System 1.0. This affects an unknown function of the file /eloginwel.php. This manipulation… |
CVE-2026-9414 | Low | 3.5 | 2026-05-25 | A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing… |
CVE-2026-9413 | Medium | 4.3 | 2026-05-25 | A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php… |
CVE-2026-9377 | Low | 2.4 | 2026-05-24 | A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The m… |
CVE-2026-9357 | Low | 3.5 | 2026-05-24 | A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting… |
CVE-2018-25349 | Medium | 6.1 | 2026-05-23 | userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attac… |
CVE-2026-41147 | High | 8.7 | 2026-05-22 | NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient s… |
CVE-2026-40607 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of… | |
CVE-2026-40598 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the requ… | |
CVE-2026-40597 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an atta… | |
CVE-2026-40596 | | 2026-05-22 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating… | |
CVE-2026-39970 | | 2026-05-22 | TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The… | |
CVE-2026-39964 | Medium | 5.4 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content witho… |
CVE-2026-36226 | Medium | 6.1 | 2026-05-22 | Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption fiel… |
CVE-2026-28445 | High | 8.7 | 2026-05-22 | Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg fie… |
CVE-2026-42506 | Medium | 6.1 | 2026-05-22 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications… |
CVE-2026-8353 | Medium | 4.8 | 2026-05-22 | Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes i… |
CVE-2026-9104 | Medium | 6.4 | 2026-05-22 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insuff… |
CVE-2026-7509 | Medium | 6.4 | 2026-05-22 | The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `the-subtitle` shortcode `before` and `after` attributes in… |
CVE-2026-6864 | Medium | 6.1 | 2026-05-22 | The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includi… |
CVE-2026-3481 | Medium | 6.1 | 2026-05-22 | The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14… |
CVE-2026-8139 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
CVE-2026-4929 | Medium | 5.4 | 2026-05-21 | Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths… |
CVE-2026-4093 | Medium | 5.4 | 2026-05-21 | In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When… |