CWE-79 · Cross-site Scripting (page 22)
Page 22 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15032 | Medium | 6.1 | 2026-08-07 | The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticat… |
CVE-2026-14331 | Medium | 6.1 | 2026-08-07 | The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to R… |
CVE-2026-12801 | Medium | 6.4 | 2026-08-07 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' at… |
CVE-2026-70332 | Critical | 9.6 | 2026-08-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-71497 | Medium | 4.7 | 2026-08-06 | jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in… |
CVE-2026-71478 | Medium | 6.1 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link fi… |
CVE-2026-71447 | | 2026-08-06 | AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templat… | |
CVE-2026-71446 | | 2026-08-06 | AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick… | |
CVE-2026-71445 | | 2026-08-06 | AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation… | |
CVE-2026-71435 | Medium | 6.1 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered u… |
CVE-2026-54717 | Medium | 5.4 | 2026-08-06 | Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed us… |
CVE-2026-49391 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews… | |
CVE-2026-48081 | High | 8.1 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `j… |
CVE-2026-47185 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated use… | |
CVE-2026-19110 | Low | 2.4 | 2026-08-06 | A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWid… |
CVE-2025-6508 | Medium | 4.3 | 2026-08-06 | The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API d… |
CVE-2024-39024 | High | 8.8 | 2026-08-06 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
CVE-2026-66711 | High | 7.1 | 2026-08-06 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. |
CVE-2026-66707 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. |
CVE-2026-66706 | Medium | 5.9 | 2026-08-06 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. |
CVE-2026-66705 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. |
CVE-2026-66703 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. |
CVE-2026-66702 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. |
CVE-2026-66694 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. |
CVE-2026-66690 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. |
CVE-2026-66688 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions. |
CVE-2026-66664 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions. |
CVE-2026-66663 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
CVE-2026-66457 | High | 7.1 | 2026-08-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected X… |
CVE-2026-66440 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions. |
CVE-2026-66439 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions. |
CVE-2026-65565 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. |
CVE-2026-65560 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions. |
CVE-2026-65545 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. |
CVE-2026-65544 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. |
CVE-2026-65517 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions. |
CVE-2026-65515 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. |
CVE-2026-65513 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. |
CVE-2026-65509 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions. |
CVE-2026-61982 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions. |
CVE-2026-61964 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. |
CVE-2026-61963 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. |
CVE-2026-61961 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. |
CVE-2026-61959 | Medium | 6.5 | 2026-08-06 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions. |
CVE-2026-28179 | Medium | 5.9 | 2026-08-06 | Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions. |
CVE-2026-28178 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions. |
CVE-2026-28177 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions. |
CVE-2026-28143 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions. |
CVE-2026-28141 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. |
CVE-2026-28082 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. |
CVE-2026-18501 | Medium | 6.4 | 2026-08-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2026-8166 | Medium | 5.4 | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing P… |
CVE-2026-5391 | Medium | 6.4 | 2026-08-06 | The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode… |
CVE-2026-5158 | Medium | 6.4 | 2026-08-06 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlace… |
CVE-2025-15028 | High | 7.2 | 2026-08-06 | The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-18510 | High | 7.2 | 2026-08-06 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (UR… |
CVE-2026-18400 | Medium | 6.4 | 2026-08-06 | The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post… |
CVE-2026-18395 | Medium | 5.4 | 2026-08-06 | The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing… |
CVE-2026-16537 | Medium | 5.4 | 2026-08-06 | The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing use… |
CVE-2026-11588 | Medium | 6.1 | 2026-08-06 | The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before… |
CVE-2025-15678 | Medium | 6.1 | 2026-08-06 | The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by defau… |
CVE-2026-18325 | High | 7.2 | 2026-08-06 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Rec… |
CVE-2026-16636 | High | 7.2 | 2026-08-06 | The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2026-18968 | Medium | 4.3 | 2026-08-06 | A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the… |
CVE-2026-70441 | Medium | 5.4 | 2026-08-05 | Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site sc… |
CVE-2026-70440 | Medium | 5.4 | 2026-08-05 | Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a sto… |
CVE-2026-20198 | Medium | 4.8 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct… |
CVE-2026-9195 | Critical | 9.3 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authentic… |
CVE-2026-70596 | Medium | 4.3 | 2026-08-05 | Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featur… |
CVE-2026-53992 | Medium | 6.1 | 2026-08-05 | ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML an… |
CVE-2026-17506 | High | 7.2 | 2026-08-05 | The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and… |
CVE-2026-71285 | High | 8.1 | 2026-08-05 | Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript ex… |
CVE-2026-71275 | Medium | 5.4 | 2026-08-05 | OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OT… |
CVE-2026-71274 | High | 8.5 | 2026-08-05 | OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitiz… |
CVE-2026-71249 | Medium | 6.1 | 2026-08-05 | 299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page… |
CVE-2026-71236 | High | 8.7 | 2026-08-05 | Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then… |
CVE-2026-71233 | High | 8.7 | 2026-08-05 | InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/v… |
CVE-2026-15452 | Medium | 4.7 | 2026-08-05 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query Strin… |
CVE-2026-7441 | Medium | 6.4 | 2026-08-05 | The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode… |
CVE-2026-6972 | Medium | 6.4 | 2026-08-05 | The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versi… |
CVE-2026-5116 | Medium | 4.4 | 2026-08-05 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This… |
CVE-2026-5108 | Medium | 4.4 | 2026-08-05 | The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in al… |
CVE-2026-17532 | Medium | 6.1 | 2026-08-05 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and i… |
CVE-2026-17505 | Medium | 6.1 | 2026-08-05 | The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to… |
CVE-2026-16942 | Medium | 5.4 | 2026-08-05 | The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed… |
CVE-2026-16583 | Medium | 6.1 | 2026-08-05 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files w… |
CVE-2026-16573 | High | 7.5 | 2026-08-05 | The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a cra… |
CVE-2025-15677 | Low | 3.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing hi… |
CVE-2026-8790 | Medium | 6.1 | 2026-08-05 | The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all version… |
CVE-2026-16143 | High | 7.2 | 2026-08-05 | The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the book… |
CVE-2026-52370 | Medium | 6.1 | 2026-08-04 | A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context… |
CVE-2026-51144 | Medium | 6.1 | 2026-08-04 | Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role… |
CVE-2026-70588 | Medium | 5.0 | 2026-08-04 | Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported conten… |
CVE-2026-70492 | High | 8.7 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/Katex… |
CVE-2026-65986 | | 2026-08-04 | CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be a… | |
CVE-2026-70486 | High | 8.2 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch… |
CVE-2026-66300 | Medium | 5.0 | 2026-08-04 | SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaSc… |
CVE-2026-10032 | Medium | 6.1 | 2026-08-04 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply… |
CVE-2026-67196 | Medium | 5.4 | 2026-08-04 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by w… |
CVE-2026-14337 | | 2026-08-04 | Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high… |