CWE-79 · Cross-site Scripting (page 26)
Page 26 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-36761 | Medium | 6.1 | 2026-04-30 | A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrary web scripts or HT… |
CVE-2026-38940 | Medium | 6.1 | 2026-04-30 | Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produk.php component |
CVE-2026-38939 | Medium | 6.1 | 2026-04-30 | Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via t… |
CVE-2026-1493 | Medium | 5.4 | 2026-04-30 | LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an a… |
CVE-2026-7401 | Medium | 4.3 | 2026-04-29 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the fi… |
CVE-2018-25309 | High | 7.2 | 2026-04-29 | MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with cr… |
CVE-2026-7390 | Low | 3.5 | 2026-04-29 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?pa… |
CVE-2026-40230 | Medium | 5.4 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor priv… |
CVE-2026-40229 | Medium | 5.4 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account na… |
CVE-2025-56537 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-56536 | Medium | 6.1 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay… |
CVE-2025-56535 | Medium | 6.1 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload in… |
CVE-2025-56534 | Medium | 6.1 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2026-42524 | High | 8.0 | 2026-04-29 | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2026-42523 | Critical | 9.0 | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook tri… |
CVE-2026-42652 | High | 7.1 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Refl… |
CVE-2026-42643 | Medium | 5.9 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Widget image-widget allows Stored XSS.Thi… |
CVE-2026-2902 | Medium | 6.1 | 2026-04-29 | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' function's 'WPMETEO… |
CVE-2025-10503 | Medium | 6.1 | 2026-04-29 | The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This al… |
CVE-2026-42615 | High | 7.2 | 2026-04-29 | GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring. |
CVE-2026-7297 | Low | 2.4 | 2026-04-28 | A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function save_user of the file /admin/ajax.php?ac… |
CVE-2026-7296 | Low | 2.4 | 2026-04-28 | A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the file /admin/ajax.php?action=save_order. P… |
CVE-2026-37750 | Medium | 6.1 | 2026-04-28 | A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to execute arbitrary Jav… |
CVE-2026-7295 | Low | 2.4 | 2026-04-28 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?act… |
CVE-2026-7294 | Low | 2.4 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /admin/index.php… |
CVE-2026-38949 | High | 8.9 | 2026-04-28 | Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The appli… |
CVE-2026-38948 | Medium | 5.4 | 2026-04-28 | Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize… |
CVE-2026-7281 | Low | 2.4 | 2026-04-28 | A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?… |
CVE-2026-7269 | Low | 2.4 | 2026-04-28 | A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?page=product. Perfo… |
CVE-2026-4805 | Medium | 6.4 | 2026-04-28 | The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input saniti… |
CVE-2026-7230 | Medium | 4.3 | 2026-04-28 | A vulnerability was found in SourceCodester Safety Anger Pad 1.0. The affected element is an unknown function. The manipulation of the argument angerDisplay re… |
CVE-2026-6809 | Medium | 6.4 | 2026-04-28 | The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0… |
CVE-2026-6725 | Medium | 6.4 | 2026-04-28 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcsm_text_rotator` s… |
CVE-2026-6551 | Medium | 6.4 | 2026-04-28 | The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-time… |
CVE-2026-7222 | Low | 3.5 | 2026-04-28 | A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/mo… |
CVE-2026-7200 | Medium | 4.3 | 2026-04-28 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?pa… |
CVE-2026-5362 | Medium | 5.4 | 2026-04-27 | An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution wh… |
CVE-2026-29971 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0. User-controlled input is reflected into… |
CVE-2026-38936 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter |
CVE-2026-38935 | Medium | 6.1 | 2026-04-27 | A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter |
CVE-2026-41467 | Medium | 5.4 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() funct… |
CVE-2026-41466 | Medium | 5.4 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText() function within Security.php that fails t… |
CVE-2026-7129 | Medium | 4.3 | 2026-04-27 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories… |
CVE-2026-7116 | Medium | 4.3 | 2026-04-27 | A security flaw has been discovered in code-projects Employee Management System 1.0. This issue affects some unknown processing of the file 370project/mark.php… |
CVE-2026-42410 | Medium | 6.5 | 2026-04-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows… |
CVE-2026-7110 | Low | 3.5 | 2026-04-27 | A flaw has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /item. Executing a manipulation of the argume… |
CVE-2026-7095 | Medium | 4.3 | 2026-04-27 | A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. The manipulation… |
CVE-2026-7090 | Low | 2.4 | 2026-04-27 | A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Inter… |
CVE-2026-7089 | Medium | 4.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of th… |
CVE-2026-7027 | Low | 2.4 | 2026-04-26 | A vulnerability was identified in D-Link DSL-2740R EU_01.15. Impacted is an unknown function of the component Wireless Setup Section. Such manipulation of the… |
CVE-2026-7026 | Medium | 4.5 | 2026-04-26 | A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processing of the component System Information Settings Page. This… |
CVE-2026-7016 | Low | 2.4 | 2026-04-26 | A vulnerability was found in MaxSite CMS up to 109.3. Impacted is an unknown function of the component ushki Plugin. Performing a manipulation of the argument… |
CVE-2026-7015 | Low | 2.4 | 2026-04-26 | A vulnerability has been found in MaxSite CMS up to 109.3. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of t… |
CVE-2026-7014 | Low | 2.4 | 2026-04-26 | A flaw has been found in MaxSite CMS up to 109.3. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument… |
CVE-2026-7013 | Low | 2.4 | 2026-04-26 | A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin… |
CVE-2026-7012 | Low | 2.4 | 2026-04-26 | A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/… |
CVE-2026-7011 | Low | 2.4 | 2026-04-26 | A weakness has been identified in MaxSite CMS up to 109.3. Affected by this vulnerability is an unknown functionality of the file /admin/plugin_antispam of the… |
CVE-2026-7001 | Low | 2.4 | 2026-04-25 | A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulat… |
CVE-2026-7000 | Low | 2.4 | 2026-04-25 | A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709. Affected by this issue is some unknown functionality of the component VLAN Page. Such manipu… |
CVE-2026-6999 | Low | 2.4 | 2026-04-25 | A flaw has been found in BIVOCOM TR321 21.1.1.50. Affected by this vulnerability is an unknown functionality of the component Wireless Setting. This manipulati… |
CVE-2026-6998 | Low | 2.4 | 2026-04-25 | A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipula… |
CVE-2026-6997 | Low | 2.4 | 2026-04-25 | A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page… |
CVE-2026-6996 | Low | 2.4 | 2026-04-25 | A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This affects an unknown function of the component rmon event Tab. Executing a manipul… |
CVE-2026-6995 | Low | 2.4 | 2026-04-25 | A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /index.asp of the compon… |
CVE-2026-6990 | Low | 3.5 | 2026-04-25 | A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a ma… |
CVE-2026-41472 | Medium | 6.1 | 2026-04-24 | CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endp… |
CVE-2026-41426 | Medium | 6.1 | 2026-04-24 | pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configu… |
CVE-2026-41421 | High | 8.8 | 2026-04-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron rend… |
CVE-2026-41067 | Medium | 6.1 | 2026-04-24 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to… |
CVE-2026-31050 | Medium | 4.9 | 2026-04-24 | Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code |
CVE-2025-61872 | Medium | 6.1 | 2026-04-24 | Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search si… |
CVE-2026-4313 | | 2026-04-24 | AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST… | |
CVE-2026-41043 | Medium | 6.5 | 2026-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker… |
CVE-2026-4078 | Medium | 6.4 | 2026-04-24 | The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes (iteras-ordering, iteras-signup, iteras-paywall-login, ite… |
CVE-2026-5428 | Medium | 6.4 | 2026-04-24 | The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in ver… |
CVE-2026-41430 | Medium | 6.1 | 2026-04-24 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on l… |
CVE-2026-41318 | Medium | 5.4 | 2026-04-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, AnythingLL… |
CVE-2026-41305 | Medium | 6.1 | 2026-04-24 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 d… |
CVE-2026-31953 | Medium | 6.4 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) v… |
CVE-2026-41241 | High | 8.7 | 2026-04-23 | pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and us… |
CVE-2026-41240 | Medium | 6.1 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_… |
CVE-2026-41239 | Medium | 6.8 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` s… |
CVE-2026-41238 | Medium | 6.9 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XS… |
CVE-2026-40472 | Critical | 9.9 | 2026-04-23 | In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Sc… |
CVE-2026-40470 | Critical | 9.9 | 2026-04-23 | A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation u… |
CVE-2026-28040 | Medium | 6.5 | 2026-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allo… |
CVE-2025-62110 | Medium | 6.5 | 2026-04-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This is… |
CVE-2026-4512 | Low | 3.5 | 2026-04-23 | The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context v… |
CVE-2026-3361 | Medium | 6.4 | 2026-04-23 | The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up to, and including… |
CVE-2026-3007 | Medium | 5.4 | 2026-04-23 | Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that… |
CVE-2026-2951 | Medium | 5.4 | 2026-04-23 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and in… |
CVE-2026-41200 | | 2026-04-23 | STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through… | |
CVE-2026-1923 | Medium | 6.4 | 2026-04-23 | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and i… |
CVE-2026-4919 | Medium | 4.8 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript code in… |
CVE-2026-4918 | Medium | 5.5 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript… |
CVE-2026-3837 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected docu… |
CVE-2026-3673 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are… |
CVE-2026-5262 | High | 8.0 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under cert… |
CVE-2026-30139 | Medium | 6.1 | 2026-04-22 | A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attackers to execute ar… |
CVE-2024-58344 | Medium | 6.4 | 2026-04-22 | Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code throug… |