CWE-79 · Cross-site Scripting (page 25)
Page 25 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41576 | High | 7.1 | 2026-05-08 | Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is p… |
CVE-2026-41575 | Medium | 6.1 | 2026-05-08 | In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting (XSS) vulnerability was identified in an IP Reputation Checker appli… |
CVE-2026-41524 | High | 8.7 | 2026-05-08 | Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the… |
CVE-2026-7650 | Medium | 6.4 | 2026-05-08 | The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `e2pdf-download` shor… |
CVE-2026-7475 | Medium | 6.4 | 2026-05-08 | The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sky-custom-scripts` custom post type in all versions up to, and inclu… |
CVE-2026-5341 | Medium | 6.4 | 2026-05-08 | The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr_connect` shortcode in all versions up… |
CVE-2026-7330 | High | 7.2 | 2026-05-08 | The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient… |
CVE-2024-33724 | Medium | 5.4 | 2026-05-08 | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. |
CVE-2023-42345 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. |
CVE-2023-42343 | Medium | 6.1 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. |
CVE-2022-23961 | Medium | 6.1 | 2026-05-08 | In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated re… |
CVE-2026-8136 | Low | 2.4 | 2026-05-08 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /index.php?page=users. Executing a ma… |
CVE-2026-42150 | Medium | 5.1 | 2026-05-08 | wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without… |
CVE-2026-8117 | Medium | 4.3 | 2026-05-08 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unknown processing of the file /admin/index… |
CVE-2026-8106 | Medium | 6.1 | 2026-05-07 | A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The re… |
CVE-2026-41929 | Medium | 6.1 | 2026-05-07 | Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to ex… |
CVE-2026-32207 | High | 8.8 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoof… |
CVE-2026-41692 | Medium | 4.7 | 2026-05-07 | i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{k… |
CVE-2026-39823 | Medium | 6.1 | 2026-05-07 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert A… |
CVE-2026-44742 | High | 7.2 | 2026-05-07 | Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026. |
CVE-2026-41904 | High | 7.6 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store a… |
CVE-2026-41653 | | 2026-05-07 | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacke… | |
CVE-2026-36388 | Medium | 5.4 | 2026-05-07 | A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows… |
CVE-2026-36341 | Medium | 5.4 | 2026-05-07 | Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during… |
CVE-2025-67202 | Medium | 6.1 | 2026-05-07 | Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended… |
CVE-2026-41554 | High | 7.1 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects… |
CVE-2026-5784 | High | 8.8 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-8080 | Medium | 5.4 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects M… |
CVE-2026-3953 | High | 8.8 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software Industry and Trade Ltd. Co. Proticaret E-… |
CVE-2026-27421 | Medium | 6.5 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS. This i… |
CVE-2025-62127 | Medium | 5.9 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Logo Slider allows DOM-Based XSS. This is… |
CVE-2026-41661 | Medium | 6.1 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's… |
CVE-2026-41201 | Critical | 9.1 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4… |
CVE-2026-40296 | Medium | 5.4 | 2026-05-06 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value d… |
CVE-2026-40171 | | 2026-05-06 | In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab… | |
CVE-2026-8012 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbi… |
CVE-2026-7958 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-7939 | Medium | 5.4 | 2026-05-06 | Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a… |
CVE-2026-36358 | Medium | 5.4 | 2026-05-06 | Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Add Banner Ads functi… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2025-31970 | Medium | 5.3 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for… |
CVE-2026-42509 | Medium | 6.1 | 2026-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8… |
CVE-2026-7457 | Medium | 6.4 | 2026-05-06 | The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sa… |
CVE-2026-7332 | High | 7.2 | 2026-05-06 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_form_pag… |
CVE-2026-6672 | Medium | 6.4 | 2026-05-06 | The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up… |
CVE-2026-23928 | | 2026-05-06 | The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow… | |
CVE-2026-23926 | | 2026-05-06 | An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that m… | |
CVE-2026-38947 | Medium | 6.1 | 2026-05-05 | FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin. |
CVE-2026-35453 | Medium | 5.4 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through… |
CVE-2026-38432 | Medium | 6.1 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email temp… |
CVE-2025-52206 | Medium | 4.7 | 2026-05-05 | ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. |
CVE-2026-27694 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-c… |
CVE-2023-54349 | Medium | 6.1 | 2026-05-05 | AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloa… |
CVE-2026-5159 | Medium | 6.4 | 2026-05-05 | The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' settin… |
CVE-2026-4803 | High | 7.2 | 2026-05-05 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX… |
CVE-2026-4665 | Medium | 6.4 | 2026-05-05 | The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, an… |
CVE-2026-6704 | Medium | 6.1 | 2026-05-05 | The Blog Settings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0. This… |
CVE-2026-6696 | Medium | 6.1 | 2026-05-05 | The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'first_name', 'last_name', and 'phone' paramete… |
CVE-2026-6255 | Medium | 6.4 | 2026-05-05 | The Simple Owl Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'num' attribute of the 'owls_wrapper' shortcode in all vers… |
CVE-2026-5505 | Medium | 6.4 | 2026-05-05 | The WP-Clippy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `clippy` shortcode in all versions up to, and including, 1.0.0… |
CVE-2026-5247 | Medium | 5.5 | 2026-05-05 | The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [future… |
CVE-2026-4730 | Medium | 6.4 | 2026-05-05 | The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-2868 | Medium | 6.4 | 2026-05-05 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG'… |
CVE-2026-42235 | Critical | 9.6 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP… |
CVE-2026-42138 | Medium | 6.1 | 2026-05-04 | Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an S… |
CVE-2026-42086 | Medium | 4.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sen… |
CVE-2026-42052 | | 2026-05-04 | Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted… | |
CVE-2026-42090 | Critical | 9.6 | 2026-05-04 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook iOS/Android version… |
CVE-2026-38669 | Medium | 6.1 | 2026-05-04 | wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog. |
CVE-2026-31205 | Medium | 5.7 | 2026-05-04 | Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageCon… |
CVE-2025-14320 | Critical | 9.8 | 2026-05-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited… |
CVE-2026-7371 | High | 7.4 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially… |
CVE-2026-42366 | High | 7.4 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially… |
CVE-2026-5063 | High | 7.2 | 2026-05-03 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submi… |
CVE-2026-7677 | Low | 3.5 | 2026-05-03 | A vulnerability was determined in kerwincui FastBee up to 1.2.1. The impacted element is the function Add of the file springboot/fastbee-admin/src/main/java/co… |
CVE-2026-0703 | Medium | 6.4 | 2026-05-02 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwcty_current_date' sho… |
CVE-2026-6817 | Medium | 5.8 | 2026-05-02 | The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to, and including, 6… |
CVE-2026-4790 | Medium | 5.4 | 2026-05-02 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_svg… |
CVE-2026-5077 | Medium | 5.4 | 2026-05-02 | The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output e… |
CVE-2026-5324 | High | 7.2 | 2026-05-02 | The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is… |
CVE-2026-6916 | Medium | 6.4 | 2026-05-02 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-6447 | Medium | 4.4 | 2026-05-02 | The Call for Price for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2026-5113 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Consent field hidden inputs in versions up to and including 2.10.0. Thi… |
CVE-2026-5112 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5111 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input v… |
CVE-2026-5110 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insu… |
CVE-2026-5109 | High | 7.2 | 2026-05-02 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient validat… |
CVE-2026-4658 | Medium | 6.4 | 2026-05-02 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className… |
CVE-2026-7209 | Medium | 6.4 | 2026-05-02 | The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in all versions up to… |
CVE-2026-6378 | Medium | 6.4 | 2026-05-02 | The Maxi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `/wp-json/maxi-blocks/v1.0/style-card` REST API endpoint in all versi… |
CVE-2026-7596 | Medium | 4.3 | 2026-05-01 | A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/… |
CVE-2025-69606 | Medium | 6.1 | 2026-05-01 | Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gateways.php/error` endpoin… |
CVE-2026-37503 | Medium | 6.9 | 2026-05-01 | Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board… |
CVE-2026-40201 | Medium | 5.4 | 2026-05-01 | @diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file. |
CVE-2026-6127 | Medium | 6.4 | 2026-05-01 | The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _elementor_data meta field in versions up to, and inclu… |
CVE-2024-13362 | Medium | 6.1 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inp… |
CVE-2026-7501 | Low | 3.5 | 2026-04-30 | A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Ex… |
CVE-2026-7429 | Medium | 4.6 | 2026-04-30 | SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by cr… |
CVE-2026-36766 | Medium | 5.4 | 2026-04-30 | Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbi… |
CVE-2026-36763 | Medium | 6.1 | 2026-04-30 | A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web… |