CWE-79 · Cross-site Scripting (page 28)
Page 28 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3369 | Medium | 5.4 | 2026-04-16 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up… |
CVE-2025-6024 | Medium | 6.1 | 2026-04-16 | The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage th… |
CVE-2024-4867 | Medium | 5.4 | 2026-04-16 | The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency… |
CVE-2024-10242 | Medium | 6.1 | 2026-04-16 | The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malic… |
CVE-2026-3995 | Medium | 4.4 | 2026-04-16 | The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0… |
CVE-2026-3876 | High | 7.2 | 2026-04-16 | The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-shortcode in all versions up to, and includi… |
CVE-2026-3875 | Medium | 6.4 | 2026-04-16 | The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocs_feedback_form' shortcode in all versions up to, and includ… |
CVE-2026-3355 | Medium | 6.1 | 2026-04-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘crsearch’ parameter in all versions up to, a… |
CVE-2026-1572 | Medium | 6.4 | 2026-04-16 | The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings i… |
CVE-2025-13364 | Medium | 6.4 | 2026-04-16 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-3551 | Medium | 4.4 | 2026-04-16 | The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and i… |
CVE-2026-5070 | Medium | 6.4 | 2026-04-16 | The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery block text content in versions up to, and including, 1.20.32 due to in… |
CVE-2026-4032 | Medium | 6.1 | 2026-04-16 | The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and in… |
CVE-2026-3878 | Medium | 6.4 | 2026-04-16 | The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and includin… |
CVE-2026-3885 | Medium | 6.4 | 2026-04-16 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all ver… |
CVE-2026-3299 | Medium | 6.4 | 2026-04-16 | The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1… |
CVE-2026-40179 | Medium | 6.1 | 2026-04-15 | Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting v… |
CVE-2026-1711 | Medium | 4.8 | 2026-04-15 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileg… |
CVE-2026-40186 | Medium | 6.1 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-… |
CVE-2026-35569 | High | 8.7 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related… |
CVE-2026-33889 | Medium | 5.4 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostr… |
CVE-2026-6370 | Medium | 5.9 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored X… |
CVE-2026-20132 | Medium | 4.8 | 2026-04-15 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with admin… |
CVE-2026-20059 | Medium | 6.1 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS atta… |
CVE-2025-15636 | Medium | 6.5 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows S… |
CVE-2026-40734 | Medium | 6.5 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Bas… |
CVE-2026-5717 | Medium | 6.4 | 2026-04-15 | The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attribute of the 'include-post-by-cat' shor… |
CVE-2026-5694 | High | 7.2 | 2026-04-15 | The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions… |
CVE-2026-4011 | Medium | 6.4 | 2026-04-15 | The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and… |
CVE-2026-4005 | Medium | 6.4 | 2026-04-15 | The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and incl… |
CVE-2026-3998 | Medium | 6.4 | 2026-04-15 | The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions u… |
CVE-2026-3659 | Medium | 6.4 | 2026-04-15 | The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [circliful] shortcode and via multip… |
CVE-2026-3643 | High | 7.2 | 2026-04-15 | The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin regis… |
CVE-2025-40899 | High | 8.9 | 2026-04-15 | A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authentic… |
CVE-2026-5160 | Medium | 6.1 | 2026-04-15 | Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL valid… |
CVE-2026-26291 | Medium | 5.4 | 2026-04-15 | Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user… |
CVE-2026-40096 | Medium | 5.4 | 2026-04-15 | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared albu… |
CVE-2026-2834 | High | 7.2 | 2026-04-15 | The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ paramete… |
CVE-2026-2396 | Medium | 4.4 | 2026-04-15 | The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up to, and including… |
CVE-2026-34212 | Medium | 5.4 | 2026-04-14 | Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows… |
CVE-2026-33193 | Medium | 4.6 | 2026-04-14 | Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due… |
CVE-2026-34161 | Medium | 5.4 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the soci… |
CVE-2026-25133 | Medium | 4.8 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in… |
CVE-2026-34625 | Medium | 5.4 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th… |
CVE-2026-34624 | Medium | 5.4 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th… |
CVE-2026-34623 | Medium | 5.4 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th… |
CVE-2026-34617 | High | 8.7 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could result in privilege escalation. A low-pr… |
CVE-2026-34614 | Medium | 6.1 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a vic… |
CVE-2026-32196 | Medium | 6.1 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofin… |
CVE-2026-27288 | Medium | 5.4 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th… |
CVE-2026-27246 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-27245 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-27243 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-24907 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in… |
CVE-2026-24906 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in… |
CVE-2026-21331 | Medium | 6.1 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a vic… |
CVE-2026-20945 | Medium | 4.6 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-39812 | Medium | 4.8 | 2026-04-14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox… |
CVE-2026-22154 | Medium | 4.6 | 2026-04-14 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR… |
CVE-2025-65136 | Medium | 6.1 | 2026-04-14 | In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter. |
CVE-2025-65134 | Medium | 6.1 | 2026-04-14 | In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POS… |
CVE-2025-65132 | Medium | 6.1 | 2026-04-14 | alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute… |
CVE-2025-61886 | Medium | 5.4 | 2026-04-14 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2026-4914 | Medium | 5.4 | 2026-04-14 | Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interacti… |
CVE-2026-4369 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Store… |
CVE-2026-4345 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk… |
CVE-2026-4344 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-… |
CVE-2026-37980 | Medium | 6.9 | 2026-04-14 | A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administra… |
CVE-2025-69993 | Medium | 6.1 | 2026-04-14 | Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as… |
CVE-2026-4479 | Medium | 4.4 | 2026-04-14 | The WholeSale Products Dynamic Pricing Management WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… |
CVE-2026-4059 | Medium | 6.4 | 2026-04-14 | The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the woolentor_quickview_button shortcode's button_text attribute in all ve… |
CVE-2026-1607 | Medium | 6.4 | 2026-04-14 | The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `surbma-bookingcom` shortcode in all vers… |
CVE-2026-4388 | High | 7.2 | 2026-04-14 | The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form submissions in all… |
CVE-2026-39426 | Medium | 5.4 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability where the frontend's Md… |
CVE-2026-39423 | Medium | 5.4 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that all… |
CVE-2026-39422 | Medium | 5.4 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application… |
CVE-2026-27683 | Medium | 4.1 | 2026-04-14 | SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a vic… |
CVE-2026-0512 | Medium | 6.1 | 2026-04-14 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could… |
CVE-2026-6218 | Medium | 4.3 | 2026-04-13 | A vulnerability was found in aandrew-me ytDownloader up to 3.20.2. Affected by this issue is the function createTextNode of the component Error Details Panel… |
CVE-2026-6216 | Low | 3.5 | 2026-04-13 | A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the co… |
CVE-2025-70936 | Medium | 5.4 | 2026-04-13 | Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controlled input in the _fo… |
CVE-2026-40038 | High | 7.2 | 2026-04-13 | Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloa… |
CVE-2026-23891 | High | 8.7 | 2026-04-13 | Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name… |
CVE-2026-6184 | Low | 2.4 | 2026-04-13 | A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executin… |
CVE-2026-30812 | Medium | 5.4 | 2026-04-13 | Improper Neutralization of Input During Web Page Generation vulnerability allows Stored Cross-Site Scripting via event comments. This issue affects Pandora FMS… |
CVE-2025-63743 | Medium | 5.4 | 2026-04-13 | Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowes… |
CVE-2026-31281 | High | 8.0 | 2026-04-13 | Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the appl… |
CVE-2026-2728 | Medium | 4.8 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires ad… |
CVE-2026-35565 | Medium | 5.4 | 2026-04-13 | Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualizat… |
CVE-2025-15632 | Low | 3.5 | 2026-04-13 | A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such man… |
CVE-2026-6162 | Low | 3.5 | 2026-04-13 | A vulnerability has been found in PHPGurukul Company Visitor Management System 2.0. This impacts an unknown function of the file /bwdates-reports-details.php… |
CVE-2026-6159 | Medium | 4.3 | 2026-04-13 | A vulnerability has been found in code-projects Simple ChatBox up to 1.0. Affected by this vulnerability is an unknown functionality of the file /chatbox/inser… |
CVE-2026-6179 | Medium | 5.4 | 2026-04-13 | Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser |
CVE-2026-6150 | Medium | 4.3 | 2026-04-13 | A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of… |
CVE-2017-20239 | Medium | 6.1 | 2026-04-12 | MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the locat… |
CVE-2026-1116 | Medium | 6.1 | 2026-04-12 | A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0… |
CVE-2026-6107 | Low | 3.5 | 2026-04-12 | A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py… |
CVE-2026-6106 | Low | 3.5 | 2026-04-11 | A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middlewar… |
CVE-2026-31845 | Critical | 9.3 | 2026-04-11 | A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarm… |
CVE-2026-23900 | Medium | 6.5 | 2026-04-11 | Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered. |