CWE-79 · Cross-site Scripting (page 22)
Page 22 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22678 | Medium | 5.4 | 2026-05-21 | Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that al… |
CVE-2026-8203 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can… |
CVE-2026-8197 | Medium | 4.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlle… |
CVE-2026-48230 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject… |
CVE-2026-48229 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48228 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48227 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48226 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48225 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary Ja… |
CVE-2026-48224 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48223 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48222 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48221 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48220 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48219 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48218 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to injec… |
CVE-2026-48217 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbi… |
CVE-2026-48216 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48215 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48214 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48213 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary Java… |
CVE-2026-6841 | Medium | 6.1 | 2026-05-21 | Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL tha… |
CVE-2026-1543 | Medium | 6.4 | 2026-05-21 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15… |
CVE-2026-4811 | Medium | 4.9 | 2026-05-21 | The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon… |
CVE-2026-39960 | Medium | 5.4 | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custo… |
CVE-2026-9144 | High | 7.6 | 2026-05-20 | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allo… |
CVE-2026-47099 | Medium | 6.1 | 2026-05-20 | TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript b… |
CVE-2026-39311 | Medium | 6.8 | 2026-05-20 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain… |
CVE-2026-35016 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-35015 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbit… |
CVE-2026-35014 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-35013 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitr… |
CVE-2026-35012 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitr… |
CVE-2026-35011 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary Ja… |
CVE-2026-35010 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitra… |
CVE-2026-35009 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-35008 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-35007 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitr… |
CVE-2026-26028 | Medium | 6.1 | 2026-05-20 | CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incom… |
CVE-2026-30691 | Medium | 6.1 | 2026-05-20 | Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file… |
CVE-2026-7613 | High | 7.2 | 2026-05-20 | The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in ver… |
CVE-2026-44924 | Medium | 5.4 | 2026-05-20 | InfoScale VIOM 9.1.3 allows XSS. |
CVE-2026-5783 | High | 7.6 | 2026-05-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co… |
CVE-2026-4293 | Medium | 5.3 | 2026-05-20 | The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which… |
CVE-2026-24573 | Medium | 6.5 | 2026-05-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS. This issue affec… |
CVE-2026-2955 | Medium | 6.4 | 2026-05-20 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up… |
CVE-2026-7460 | | 2026-05-20 | mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /… | |
CVE-2026-8627 | Medium | 6.1 | 2026-05-20 | The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1… |
CVE-2026-8626 | Medium | 6.1 | 2026-05-20 | The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to in… |
CVE-2026-8624 | Medium | 6.1 | 2026-05-20 | The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and includi… |
CVE-2026-8038 | Medium | 6.4 | 2026-05-20 | The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in a… |
CVE-2026-7462 | Medium | 6.1 | 2026-05-20 | The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. T… |
CVE-2026-6549 | Medium | 6.4 | 2026-05-20 | The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the `vc_enamad_namad`, `vc_enamad_sh… |
CVE-2026-6404 | Medium | 4.4 | 2026-05-20 | The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versio… |
CVE-2026-6399 | Medium | 4.4 | 2026-05-20 | The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize… |
CVE-2026-6397 | Medium | 6.4 | 2026-05-20 | The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `cvmh-sticky` shortcode `readmoretext` attribute in versions up to and inc… |
CVE-2026-5293 | Medium | 6.4 | 2026-05-20 | The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and includ… |
CVE-2026-8493 | Medium | 5.4 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS)… |
CVE-2026-6871 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This… |
CVE-2026-6367 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th… |
CVE-2026-6365 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th… |
CVE-2026-6095 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This i… |
CVE-2026-5090 | Medium | 6.1 | 2026-05-19 | Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML… |
CVE-2026-34463 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating… | |
CVE-2026-34241 | High | 8.7 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the tick… |
CVE-2026-33741 | Medium | 6.8 | 2026-05-19 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through no… |
CVE-2026-8948 | Critical | 9.1 | 2026-05-19 | Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2025-40904 | Medium | 6.5 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40903 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authent… |
CVE-2025-40902 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with ad… |
CVE-2025-40901 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticate… |
CVE-2026-31906 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24… |
CVE-2026-31379 | Medium | 6.1 | 2026-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traver… |
CVE-2026-27964 | Low | 3.9 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability thro… |
CVE-2026-27737 | Medium | 6.5 | 2026-05-18 | BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in… |
CVE-2026-45231 | Medium | 6.1 | 2026-05-18 | DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags… |
CVE-2026-45494 | Medium | 5.4 | 2026-05-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-29965 | Medium | 6.1 | 2026-05-18 | HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplie… |
CVE-2026-29964 | Medium | 6.1 | 2026-05-18 | HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled i… |
CVE-2026-7498 | High | 8.8 | 2026-05-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organizatio… |
CVE-2026-3495 | Low | 3.8 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition whic… |
CVE-2026-6495 | High | 7.1 | 2026-05-18 | The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2026-3220 | High | 8.8 | 2026-05-18 | The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to… |
CVE-2018-25331 | Medium | 6.1 | 2026-05-17 | Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating… |
CVE-2021-47981 | Medium | 5.4 | 2026-05-16 | Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting X… |
CVE-2021-47975 | High | 7.2 | 2026-05-16 | WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fiel… |
CVE-2021-47957 | Medium | 6.4 | 2026-05-16 | Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanit… |
CVE-2021-47955 | Medium | 5.4 | 2026-05-16 | CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG fil… |
CVE-2021-47934 | Medium | 5.3 | 2026-05-16 | MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, an… |
CVE-2020-37245 | High | 7.5 | 2026-05-16 | Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web ro… |
CVE-2020-37240 | Medium | 6.4 | 2026-05-16 | Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through… |
CVE-2020-37238 | Medium | 6.4 | 2026-05-16 | CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scr… |
CVE-2020-37237 | Medium | 6.4 | 2026-05-16 | Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the b… |
CVE-2020-37236 | Medium | 6.4 | 2026-05-16 | NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through… |
CVE-2020-37235 | Medium | 6.4 | 2026-05-16 | WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scr… |
CVE-2020-37233 | Medium | 6.4 | 2026-05-16 | WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inj… |
CVE-2026-8656 | Medium | 6.1 | 2026-05-16 | Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSO… |
CVE-2026-45665 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerab… |
CVE-2026-45318 | Medium | 5.4 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the orig… |
CVE-2026-45315 | High | 8.7 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint take… |