CWE-79 · Cross-site Scripting (page 25)
Page 25 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15821 | Medium | 6.4 | 2026-07-24 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions… |
CVE-2026-15739 | Medium | 6.4 | 2026-07-24 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up… |
CVE-2026-15346 | Medium | 6.1 | 2026-07-24 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions… |
CVE-2026-15755 | Medium | 6.4 | 2026-07-24 | The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15665 | Medium | 6.4 | 2026-07-24 | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode At… |
CVE-2026-15653 | Medium | 6.4 | 2026-07-24 | The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' p… |
CVE-2026-15648 | Medium | 6.4 | 2026-07-24 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15464 | Medium | 6.4 | 2026-07-24 | The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and inclu… |
CVE-2026-15334 | Medium | 6.4 | 2026-07-24 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15333 | Medium | 6.4 | 2026-07-24 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-6454 | Medium | 6.4 | 2026-07-24 | The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficien… |
CVE-2026-15100 | Medium | 6.4 | 2026-07-24 | The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions u… |
CVE-2025-9205 | Medium | 6.4 | 2026-07-24 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sa… |
CVE-2026-15968 | High | 7.1 | 2026-07-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Tran… |
CVE-2026-65763 | | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability. | |
CVE-2026-65762 | | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerab… | |
CVE-2026-47743 | High | 8.7 | 2026-07-23 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclos… |
CVE-2026-65697 | Medium | 6.1 | 2026-07-23 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to in… |
CVE-2026-48539 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated att… |
CVE-2026-48538 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers… |
CVE-2026-48537 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers… |
CVE-2026-48536 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers t… |
CVE-2026-48535 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers… |
CVE-2026-48534 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject a… |
CVE-2026-48532 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated att… |
CVE-2026-48531 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inj… |
CVE-2026-48530 | Medium | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to… |
CVE-2026-65914 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like… |
CVE-2026-65912 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeChe… |
CVE-2026-65911 | Medium | 6.1 | 2026-07-23 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) ac… |
CVE-2026-65901 | Medium | 6.1 | 2026-07-23 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attacke… |
CVE-2026-65900 | Medium | 6.1 | 2026-07-23 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PL… |
CVE-2026-65898 | High | 7.2 | 2026-07-23 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently… |
CVE-2026-65606 | Critical | 9.6 | 2026-07-23 | SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name tha… |
CVE-2026-65605 | Critical | 9.6 | 2026-07-23 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as H… |
CVE-2026-65550 | Medium | 5.9 | 2026-07-23 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. |
CVE-2026-65538 | Medium | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. |
CVE-2026-65534 | Medium | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. |
CVE-2026-65533 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. |
CVE-2026-65528 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. |
CVE-2026-65527 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. |
CVE-2026-65522 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
CVE-2026-65519 | Medium | 6.5 | 2026-07-23 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. |
CVE-2026-65518 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. |
CVE-2026-65514 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. |
CVE-2026-65511 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
CVE-2026-65510 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-65503 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-65492 | High | 7.1 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affect… |
CVE-2026-65483 | Medium | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions. |
CVE-2026-65482 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-el… |
CVE-2026-65480 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affe… |
CVE-2026-65475 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This is… |
CVE-2026-65473 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions. |
CVE-2026-65470 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. |
CVE-2026-65465 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions. |
CVE-2026-65449 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. |
CVE-2026-64810 | Medium | 4.3 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking |
CVE-2026-61947 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. |
CVE-2026-61944 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions. |
CVE-2026-59517 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions. |
CVE-2026-59513 | Medium | 6.5 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. |
CVE-2026-59512 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions. |
CVE-2026-57809 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions. |
CVE-2026-57769 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions. |
CVE-2026-57767 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions. |
CVE-2026-57735 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions. |
CVE-2026-57704 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. |
CVE-2026-57701 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. |
CVE-2026-57699 | High | 7.1 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. |
CVE-2026-57428 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. |
CVE-2026-57427 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. |
CVE-2026-57397 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. |
CVE-2026-57384 | Medium | 6.5 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. |
CVE-2026-57374 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. |
CVE-2026-57373 | Medium | 6.5 | 2026-07-23 | Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. |
CVE-2026-57370 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. |
CVE-2026-27403 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affe… |
CVE-2026-24628 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
CVE-2025-68081 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. |
CVE-2026-65756 | Medium | 6.1 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. |
CVE-2026-15794 | Medium | 6.4 | 2026-07-23 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to… |
CVE-2026-15647 | Medium | 4.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and… |
CVE-2026-15646 | Medium | 6.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15404 | Medium | 6.4 | 2026-07-23 | The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insuffici… |
CVE-2026-15394 | Medium | 6.4 | 2026-07-23 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet… |
CVE-2026-14481 | Medium | 6.4 | 2026-07-23 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-9729 | Medium | 6.4 | 2026-07-23 | The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notificat… |
CVE-2026-9635 | Medium | 6.4 | 2026-07-23 | The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions… |
CVE-2026-12421 | High | 7.2 | 2026-07-23 | The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to in… |
CVE-2026-9577 | Medium | 4.8 | 2026-07-23 | The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page… |
CVE-2026-9066 | Medium | 6.1 | 2026-07-23 | The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the… |
CVE-2026-7534 | High | 7.2 | 2026-07-23 | The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning`… |
CVE-2026-7232 | High | 7.2 | 2026-07-23 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9… |
CVE-2026-64795 | Medium | 5.4 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title ove… |
CVE-2026-63281 | Medium | 4.8 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in admin… |
CVE-2026-64828 | Medium | 6.1 | 2026-07-22 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaS… |
CVE-2026-8152 | | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with… | |
CVE-2026-65597 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution… |
CVE-2026-65592 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-p… |