CWE-79 · Cross-site Scripting (page 23)
Page 23 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14192 | Medium | 5.4 | 2026-08-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST… |
CVE-2026-16293 | Medium | 6.8 | 2026-08-04 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could all… |
CVE-2026-16069 | Medium | 6.8 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before s… |
CVE-2026-16068 | Low | 3.5 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before… |
CVE-2026-15233 | Medium | 4.8 | 2026-08-04 | The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing s… |
CVE-2026-14824 | Medium | 4.8 | 2026-08-04 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribu… |
CVE-2026-67617 | Medium | 4.8 | 2026-08-03 | Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to i… |
CVE-2026-18682 | Low | 3.1 | 2026-08-03 | A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload AP… |
CVE-2026-52520 | Medium | 5.4 | 2026-08-03 | Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated at… |
CVE-2026-49132 | Medium | 5.4 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embed… |
CVE-2026-49131 | Medium | 5.4 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inj… |
CVE-2026-66296 | Medium | 6.1 | 2026-08-03 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error… |
CVE-2026-38446 | Medium | 6.1 | 2026-08-03 | A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input… |
CVE-2026-38444 | Medium | 6.1 | 2026-08-03 | osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in incl… |
CVE-2026-69151 | Medium | 6.1 | 2026-08-03 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19… |
CVE-2026-69149 | Medium | 6.1 | 2026-08-03 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19… |
CVE-2026-67612 | Medium | 4.8 | 2026-08-03 | OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to in… |
CVE-2026-18243 | | 2026-08-03 | Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job prev… | |
CVE-2026-69092 | Medium | 6.5 | 2026-08-03 | Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the… |
CVE-2026-69075 | | 2026-08-03 | FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—inc… | |
CVE-2026-15931 | Medium | 6.1 | 2026-08-03 | The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor es… |
CVE-2026-15383 | Medium | 6.1 | 2026-08-03 | The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated… |
CVE-2026-13340 | Medium | 6.1 | 2026-08-03 | The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and se… |
CVE-2026-68583 | Medium | 5.4 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inj… |
CVE-2026-12231 | Medium | 6.4 | 2026-08-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up… |
CVE-2026-16273 | Medium | 4.6 | 2026-08-02 | The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing u… |
CVE-2026-16063 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editin… |
CVE-2026-15385 | Medium | 5.4 | 2026-08-02 | The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item set… |
CVE-2026-14864 | Medium | 5.4 | 2026-08-02 | The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Cont… |
CVE-2026-14841 | Medium | 6.1 | 2026-08-02 | The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an u… |
CVE-2026-14817 | Medium | 6.8 | 2026-08-02 | The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled f… |
CVE-2025-15675 | Medium | 4.8 | 2026-08-02 | The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, a… |
CVE-2026-67352 | High | 7.6 | 2026-08-01 | luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HT… |
CVE-2026-67333 | High | 7.2 | 2026-08-01 | better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated… |
CVE-2026-67328 | High | 8.1 | 2026-08-01 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbi… |
CVE-2025-71404 | | 2026-08-01 | better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value o… | |
CVE-2026-18435 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribu… |
CVE-2026-18344 | Medium | 6.1 | 2026-08-01 | The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding… |
CVE-2026-18062 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image… |
CVE-2026-17571 | Medium | 6.1 | 2026-08-01 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2026-16685 | Medium | 6.4 | 2026-08-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3… |
CVE-2026-16684 | Medium | 6.4 | 2026-08-01 | The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and incl… |
CVE-2026-16091 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16090 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-15950 | Medium | 6.4 | 2026-08-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15662 | Medium | 6.4 | 2026-08-01 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' paramete… |
CVE-2026-15649 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15645 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions… |
CVE-2026-15644 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all version… |
CVE-2026-15052 | High | 7.2 | 2026-08-01 | The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Value… |
CVE-2026-13458 | Medium | 6.4 | 2026-08-01 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and in… |
CVE-2026-15262 | Medium | 5.4 | 2026-08-01 | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin lis… |
CVE-2026-15234 | Medium | 5.4 | 2026-08-01 | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering… |
CVE-2026-14292 | Medium | 5.4 | 2026-08-01 | The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowin… |
CVE-2026-13725 | High | 7.1 | 2026-08-01 | The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions… |
CVE-2026-12696 | Medium | 5.4 | 2026-08-01 | The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-13362 | Medium | 6.4 | 2026-08-01 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, a… |
CVE-2026-52232 | Medium | 6.1 | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arb… |
CVE-2026-62324 | Medium | 5.4 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl… |
CVE-2026-18481 | High | 7.3 | 2026-07-31 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-59232 | | 2026-07-31 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to… | |
CVE-2026-46594 | | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially craft… | |
CVE-2026-14922 | Medium | 6.1 | 2026-07-31 | WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encod… |
CVE-2026-14921 | Medium | 6.1 | 2026-07-31 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), |
CVE-2026-14845 | Medium | 6.1 | 2026-07-31 | The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outp… |
CVE-2026-14833 | Medium | 6.8 | 2026-07-31 | The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox captio… |
CVE-2026-13609 | High | 8.8 | 2026-07-31 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML… |
CVE-2026-13393 | Low | 3.5 | 2026-07-31 | The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outpu… |
CVE-2026-56672 | High | 8.2 | 2026-07-31 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-d… |
CVE-2026-56670 | High | 8.2 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline be… |
CVE-2026-66421 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the adm… |
CVE-2026-66418 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script… |
CVE-2026-61526 | Medium | 6.1 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the er… |
CVE-2025-65342 | Medium | 6.1 | 2026-07-30 | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. |
CVE-2025-65341 | Medium | 6.1 | 2026-07-30 | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. |
CVE-2025-51684 | Medium | 6.1 | 2026-07-30 | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before… |
CVE-2025-0152 | Medium | 6.1 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting… |
CVE-2026-11707 | Critical | 9.3 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administra… |
CVE-2026-11383 | Medium | 5.4 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. |
CVE-2025-36431 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-36298 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling Fil… |
CVE-2026-18361 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. |
CVE-2026-18360 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. |
CVE-2026-16969 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. |
CVE-2026-59328 | Medium | 4.2 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untru… |
CVE-2026-14592 | Medium | 6.1 | 2026-07-30 | The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and… |
CVE-2026-14318 | Medium | 6.8 | 2026-07-30 | The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-14207 | Medium | 6.1 | 2026-07-30 | The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing us… |
CVE-2026-13344 | Medium | 4.8 | 2026-07-30 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it… |
CVE-2026-13330 | Medium | 6.1 | 2026-07-30 | The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types… |
CVE-2026-11881 | Medium | 6.1 | 2026-07-30 | The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline… |
CVE-2026-17962 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafte… |
CVE-2026-17903 | Medium | 5.4 | 2026-07-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTM… |
CVE-2026-17878 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-17853 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject s… |
CVE-2026-17845 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |