CWE-79 · Cross-site Scripting (page 24)
Page 24 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6247 | Medium | 6.4 | 2026-05-12 | The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all… |
CVE-2026-6237 | Medium | 6.4 | 2026-05-12 | The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and… |
CVE-2026-5715 | Medium | 6.4 | 2026-05-12 | The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up… |
CVE-2026-5340 | Medium | 6.4 | 2026-05-12 | The Fancy Image Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fancy-img-show` shortcode in all versions up to, and i… |
CVE-2026-4920 | Medium | 6.4 | 2026-05-12 | The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0… |
CVE-2026-4859 | Medium | 6.4 | 2026-05-12 | The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carousel` shortcode in all… |
CVE-2026-3604 | Medium | 4.9 | 2026-05-12 | The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_kcseo_ative_tab` parameter in all versions up to… |
CVE-2026-2300 | Medium | 6.4 | 2026-05-12 | The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `filter_images()` function in all versions up to, and including, 1.0… |
CVE-2026-40137 | Medium | 6.1 | 2026-05-12 | SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to… |
CVE-2026-27682 | Medium | 4.7 | 2026-05-12 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthen… |
CVE-2026-45392 | High | 8.7 | 2026-05-12 | DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated… |
CVE-2026-43900 | Critical | 9.3 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS)… |
CVE-2026-42554 | Medium | 6.1 | 2026-05-11 | Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/J… |
CVE-2026-43887 | High | 7.3 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section permits users to mention other users; howev… |
CVE-2026-43878 | Medium | 6.1 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query p… |
CVE-2026-43876 | Medium | 6.4 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and… |
CVE-2026-45026 | Medium | 6.8 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user… |
CVE-2026-45025 | Medium | 6.8 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user… |
CVE-2026-42887 | Medium | 4.5 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due t… |
CVE-2026-42872 | Medium | 6.1 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_e… |
CVE-2026-42870 | | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoi… | |
CVE-2026-7308 | | 2026-05-11 | An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user wh… | |
CVE-2026-42857 | Medium | 4.6 | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notificat… |
CVE-2026-41250 | Medium | 5.7 | 2026-05-11 | Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in… |
CVE-2026-38569 | Medium | 5.4 | 2026-05-11 | HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /… |
CVE-2026-44737 | | 2026-05-11 | grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. P… | |
CVE-2026-42842 | Medium | 5.4 | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS For… |
CVE-2026-36906 | Medium | 6.1 | 2026-05-11 | Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function |
CVE-2026-7814 | Medium | 4.8 | 2026-05-11 | Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, s… |
CVE-2026-42841 | Medium | 4.8 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler… |
CVE-2026-42612 | High | 8.5 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to… |
CVE-2026-42611 | High | 8.9 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg ele… |
CVE-2026-3320 | | 2026-05-11 | Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML out… | |
CVE-2026-3319 | | 2026-05-11 | Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML out… | |
CVE-2026-34089 | High | 7.5 | 2026-05-11 | Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2. |
CVE-2025-65417 | Medium | 6.1 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application. |
CVE-2025-61314 | High | 7.3 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows atta… |
CVE-2025-61313 | High | 7.3 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows… |
CVE-2025-61312 | High | 7.3 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attac… |
CVE-2025-61311 | High | 7.3 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attack… |
CVE-2025-61310 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows atta… |
CVE-2025-61309 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows a… |
CVE-2025-61308 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows a… |
CVE-2025-61307 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attack… |
CVE-2025-61306 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allow… |
CVE-2025-61305 | Medium | 6.1 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows atta… |
CVE-2026-6956 | | 2026-05-11 | ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary… | |
CVE-2026-6909 | | 2026-05-11 | ATutor is vulnerable to Reflected XSS in /install/upgrade.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary… | |
CVE-2026-8262 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /accounts/chart-save. Such manipulation lead… |
CVE-2026-8256 | Low | 2.4 | 2026-05-11 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such m… |
CVE-2026-8255 | Low | 2.4 | 2026-05-11 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. This affects an unknown part of the file /inventory/add_new_customer. This manipulation c… |
CVE-2026-8254 | Low | 2.4 | 2026-05-11 | A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0. Affected by this issue is some unknown functionality of the file /inventory/sales_sa… |
CVE-2026-8253 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerability is an unknown functionality of the file /inventory/purchas… |
CVE-2022-50970 | Medium | 5.4 | 2026-05-10 | WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulat… |
CVE-2022-50969 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and cr… |
CVE-2022-50968 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50967 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. The date_created, date_from, date_to, and created_at pa… |
CVE-2022-50966 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at param… |
CVE-2022-50965 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the posts/manage module. The date_created, date_from, date_to, and created_at para… |
CVE-2022-50964 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. The date_created, date_from, date_to… |
CVE-2022-50963 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. The date_created, date_from, date_to… |
CVE-2022-50962 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the orders/myOrders module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50961 | Medium | 6.4 | 2026-05-10 | WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary Ja… |
CVE-2022-50960 | Medium | 6.1 | 2026-05-10 | WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the adm… |
CVE-2022-50959 | Medium | 6.1 | 2026-05-10 | WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50958 | Medium | 6.1 | 2026-05-10 | WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manip… |
CVE-2022-50957 | Medium | 6.1 | 2026-05-10 | Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50949 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by… |
CVE-2022-50948 | Medium | 6.4 | 2026-05-10 | Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by subm… |
CVE-2022-50947 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicio… |
CVE-2022-50946 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious script… |
CVE-2022-50945 | Medium | 6.4 | 2026-05-10 | WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious Jav… |
CVE-2022-50943 | Medium | 6.1 | 2026-05-10 | Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through t… |
CVE-2021-47951 | Medium | 6.4 | 2026-05-10 | WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through th… |
CVE-2021-47950 | Medium | 6.4 | 2026-05-10 | Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers t… |
CVE-2021-47947 | Medium | 6.4 | 2026-05-10 | Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted in… |
CVE-2021-47931 | Medium | 6.4 | 2026-05-10 | Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Tex… |
CVE-2021-47929 | Medium | 6.4 | 2026-05-10 | Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by ent… |
CVE-2021-47927 | Medium | 6.4 | 2026-05-10 | WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts… |
CVE-2021-47926 | Medium | 6.4 | 2026-05-10 | Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating f… |
CVE-2021-47925 | Medium | 6.4 | 2026-05-10 | CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via craf… |
CVE-2021-47924 | Medium | 6.4 | 2026-05-10 | Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through t… |
CVE-2021-47922 | Medium | 6.4 | 2026-05-10 | Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the titl… |
CVE-2021-47910 | Medium | 6.4 | 2026-05-10 | AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering… |
CVE-2021-47907 | Medium | 6.4 | 2026-05-10 | Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script… |
CVE-2026-6735 | Medium | 6.1 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attack… |
CVE-2026-8221 | Low | 2.4 | 2026-05-10 | A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross… |
CVE-2026-8220 | Low | 2.4 | 2026-05-10 | A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation res… |
CVE-2026-8219 | Low | 2.4 | 2026-05-10 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-s… |
CVE-2026-8218 | Low | 2.4 | 2026-05-10 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase_return_save… |
CVE-2026-8195 | Medium | 4.3 | 2026-05-09 | A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/ja… |
CVE-2026-42455 | | 2026-05-09 | Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive up… | |
CVE-2026-42556 | High | 8.9 | 2026-05-08 | Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HT… |
CVE-2026-42451 | Medium | 6.3 | 2026-05-08 | Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader al… |
CVE-2026-42224 | High | 7.6 | 2026-05-08 | ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javas… |
CVE-2026-42192 | Medium | 5.4 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaig… |
CVE-2026-42794 | Medium | 6.1 | 2026-05-08 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the… |
CVE-2026-41886 | High | 7.5 | 2026-05-08 | locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener("messag… |
CVE-2026-41683 | High | 8.6 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-… |
CVE-2026-41591 | Medium | 6.4 | 2026-05-08 | Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text i… |