CWE-79 · Cross-site Scripting (page 27)
Page 27 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-25269 | Medium | 6.1 | 2026-04-22 | ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base… |
CVE-2026-1913 | Medium | 6.4 | 2026-04-22 | The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and… |
CVE-2026-1395 | Medium | 6.4 | 2026-04-22 | The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block_id attribute in all versions up to, and incl… |
CVE-2026-6246 | Medium | 6.4 | 2026-04-22 | The Simple Random Posts Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'container_right_width' attribute of the 'simple_ra… |
CVE-2026-6236 | Medium | 6.4 | 2026-04-22 | The Posts map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute in all versions up to, and including, 0.1.3… |
CVE-2026-6041 | Medium | 4.4 | 2026-04-22 | The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all ve… |
CVE-2026-5820 | Medium | 6.4 | 2026-04-22 | The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0… |
CVE-2026-5767 | Medium | 6.4 | 2026-04-22 | The SlideShowPro SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `slideShowProSC` shortcode in all versions up to, and in… |
CVE-2026-5748 | Medium | 6.4 | 2026-04-22 | The Text Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ts` shortcode in all versions up to, and including, 0.0.1… |
CVE-2026-4353 | Medium | 6.4 | 2026-04-22 | The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `cihub_metadata` shortcode in all versions… |
CVE-2026-4279 | Medium | 6.4 | 2026-04-22 | The Bread & Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'breadbutter-customevent-button' shortcode in all versions up to… |
CVE-2026-4142 | Medium | 4.4 | 2026-04-22 | The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Permanent keywords' field in al… |
CVE-2026-4125 | Medium | 6.4 | 2026-04-22 | The WPMK Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to and including 1.0.1… |
CVE-2026-4089 | Medium | 6.4 | 2026-04-22 | The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1… |
CVE-2026-4088 | Medium | 6.4 | 2026-04-22 | The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1… |
CVE-2026-4085 | Medium | 6.4 | 2026-04-22 | The Easy Social Photos Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper_class' shortcode attribute of the 'my-instagr… |
CVE-2026-4082 | Medium | 6.4 | 2026-04-22 | The ER Swiffy Insert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [swiffy] shortcode in all versions up to and including 1.0.0. Th… |
CVE-2026-4076 | Medium | 6.4 | 2026-04-22 | The Slider Bootstrap Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'category' and 'template' shortcode attributes in all v… |
CVE-2026-4074 | Medium | 6.4 | 2026-04-22 | The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions… |
CVE-2026-3362 | Medium | 4.4 | 2026-04-22 | The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and inc… |
CVE-2026-2719 | Medium | 4.4 | 2026-04-22 | The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1… |
CVE-2026-2714 | Medium | 4.4 | 2026-04-22 | The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versions up to, and incl… |
CVE-2026-1845 | Medium | 5.5 | 2026-04-22 | The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to ins… |
CVE-2026-1379 | Medium | 4.4 | 2026-04-22 | The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insuf… |
CVE-2026-40451 | Medium | 6.1 | 2026-04-22 | DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to execute arbitrary sc… |
CVE-2026-41063 | Medium | 5.4 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMar… |
CVE-2026-41061 | Medium | 5.4 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2… |
CVE-2026-40927 | Medium | 5.4 | 2026-04-21 | Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript… |
CVE-2026-40878 | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER[… | |
CVE-2026-40875 | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections"… | |
CVE-2026-40873 | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment fil… | |
CVE-2026-40872 | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the… | |
CVE-2026-6745 | Low | 3.5 | 2026-04-21 | A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. Thi… |
CVE-2026-41456 | | 2026-04-21 | Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject… | |
CVE-2026-6743 | Low | 3.5 | 2026-04-21 | A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site sc… |
CVE-2026-40568 | High | 8.5 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox s… |
CVE-2026-35451 | Medium | 5.7 | 2026-04-21 | Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of pro… |
CVE-2026-27937 | Low | 3.1 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified… |
CVE-2026-40565 | Medium | 6.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-te… |
CVE-2025-41011 | Medium | 6.1 | 2026-04-21 | HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper v… |
CVE-2026-31013 | Medium | 6.1 | 2026-04-21 | Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR en… |
CVE-2025-10354 | | 2026-04-21 | Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's brow… | |
CVE-2026-6779 | Medium | 5.3 | 2026-04-21 | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-3317 | | 2026-04-21 | Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System. The vulnerability is present in the '/blog' endpoint because user inp… | |
CVE-2026-6712 | Medium | 4.4 | 2026-04-21 | The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to in… |
CVE-2026-6711 | Medium | 6.1 | 2026-04-21 | The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6… |
CVE-2026-40497 | High | 8.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::stripDangerousTags()` removes `<script>`, `<form>`… |
CVE-2026-5721 | Medium | 4.7 | 2026-04-20 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions… |
CVE-2026-4852 | Medium | 6.4 | 2026-04-20 | The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image Source' attach… |
CVE-2026-39112 | Medium | 5.4 | 2026-04-20 | Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameter of visitors-form… |
CVE-2026-23758 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject m… |
CVE-2026-23757 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Re… |
CVE-2026-23756 | Medium | 5.4 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized… |
CVE-2026-23753 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is pa… |
CVE-2026-23752 | Medium | 4.8 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authentica… |
CVE-2026-6651 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page… |
CVE-2026-34429 | Medium | 5.4 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute… |
CVE-2026-6648 | Low | 3.5 | 2026-04-20 | A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Module. Performing a ma… |
CVE-2026-6633 | Low | 3.5 | 2026-04-20 | A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admi… |
CVE-2026-6624 | Low | 2.4 | 2026-04-20 | A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?\_route=pool/add of the component P… |
CVE-2026-6623 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an unknown function of the file /?_route=settings/users-view/ o… |
CVE-2026-6622 | Low | 2.4 | 2026-04-20 | A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?\_route=customers/edit/ of the com… |
CVE-2026-6619 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-… |
CVE-2024-7083 | Low | 3.5 | 2026-04-20 | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2026-6600 | Low | 3.5 | 2026-04-20 | A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/cha… |
CVE-2026-32963 | Medium | 6.1 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device… |
CVE-2026-6593 | Low | 3.5 | 2026-04-20 | A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. P… |
CVE-2026-6592 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the compo… |
CVE-2026-6559 | Medium | 4.3 | 2026-04-19 | A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/login.cgi. This manipulation of the argu… |
CVE-2026-0868 | Medium | 6.4 | 2026-04-19 | The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in al… |
CVE-2026-2986 | Medium | 6.4 | 2026-04-18 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and incl… |
CVE-2026-2505 | Medium | 5.4 | 2026-04-18 | The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' sho… |
CVE-2026-0894 | Medium | 6.4 | 2026-04-18 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versi… |
CVE-2026-6048 | Medium | 6.4 | 2026-04-18 | The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget's button URL `custom_attributes` field… |
CVE-2026-4801 | Medium | 6.4 | 2026-04-18 | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up t… |
CVE-2026-40487 | High | 8.9 | 2026-04-18 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML… |
CVE-2026-1838 | Medium | 6.1 | 2026-04-18 | The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 du… |
CVE-2026-1559 | Medium | 6.4 | 2026-04-18 | The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in all versions up to, and including, 1.3.6… |
CVE-2026-40593 | Medium | 4.8 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HT… |
CVE-2026-40483 | Medium | 5.4 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input va… |
CVE-2026-40479 | Medium | 5.4 | 2026-04-17 | Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quo… |
CVE-2026-2434 | Medium | 6.4 | 2026-04-17 | The Pz-LinkCard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blogcard' shortcode attributes in all versions up to, and including… |
CVE-2026-40353 | Medium | 5.4 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by di… |
CVE-2026-40302 | Medium | 6.1 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which per… |
CVE-2026-40301 | Medium | 4.7 | 2026-04-17 | DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never ins… |
CVE-2026-40286 | High | 7.5 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Membe… |
CVE-2026-40284 | Medium | 6.8 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user… |
CVE-2026-40282 | | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user… | |
CVE-2026-33436 | Low | 3.1 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render use… |
CVE-2026-40283 | Medium | 6.8 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user… |
CVE-2026-6493 | Low | 3.5 | 2026-04-17 | A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/… |
CVE-2026-6486 | Low | 3.5 | 2026-04-17 | A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the compon… |
CVE-2026-28263 | Medium | 5.9 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2026-6439 | Medium | 4.4 | 2026-04-17 | The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitiz… |
CVE-2026-5231 | High | 7.2 | 2026-04-17 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16… |
CVE-2026-5162 | Medium | 6.4 | 2026-04-17 | The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' settin… |
CVE-2026-40922 | Medium | 5.4 | 2026-04-17 | SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix… |
CVE-2026-40262 | High | 8.7 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-… |
CVE-2026-40322 | Critical | 9.0 | 2026-04-16 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "loose", an… |
CVE-2026-2840 | Medium | 6.4 | 2026-04-16 | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode… |