CWE-79 · Cross-site Scripting (page 28)
Page 28 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57668 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows… |
CVE-2026-57423 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message… |
CVE-2026-57422 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo… |
CVE-2026-57421 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflecte… |
CVE-2026-57420 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Store… |
CVE-2026-57417 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue… |
CVE-2026-57416 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-ma… |
CVE-2026-57415 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen Gift Vouchers gift-voucher allows Stored XSS… |
CVE-2026-57414 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbo… |
CVE-2026-57411 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Cont… |
CVE-2026-57409 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-57403 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Security Headers gd-security-headers al… |
CVE-2026-57402 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce f… |
CVE-2026-57399 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn… |
CVE-2026-57398 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manage… |
CVE-2026-57396 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocomm… |
CVE-2026-57394 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Re… |
CVE-2026-57391 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows St… |
CVE-2026-57388 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-57387 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu… |
CVE-2026-57383 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issu… |
CVE-2026-57382 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows… |
CVE-2026-57381 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected… |
CVE-2026-57380 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map… |
CVE-2026-57379 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.Th… |
CVE-2026-57376 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2026-57369 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflecte… |
CVE-2026-57368 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.T… |
CVE-2026-57365 | Medium | 6.5 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Foru… |
CVE-2026-57363 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue… |
CVE-2026-57829 | Medium | 6.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthentica… |
CVE-2026-15532 | Low | 2.4 | 2026-07-13 | A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Modu… |
CVE-2026-15552 | Medium | 6.1 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent Ja… |
CVE-2026-15505 | Low | 3.5 | 2026-07-12 | A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component… |
CVE-2026-61876 | High | 8.8 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Atta… |
CVE-2026-61875 | High | 8.8 | 2026-07-12 | luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOA… |
CVE-2026-15493 | Low | 3.5 | 2026-07-12 | A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing… |
CVE-2026-15492 | Medium | 4.3 | 2026-07-12 | A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the fi… |
CVE-2026-6939 | High | 7.2 | 2026-07-11 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions u… |
CVE-2026-1382 | Medium | 6.4 | 2026-07-11 | The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including… |
CVE-2026-15010 | Medium | 6.4 | 2026-07-11 | The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fiel… |
CVE-2026-12126 | Medium | 6.4 | 2026-07-11 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in… |
CVE-2026-11898 | Medium | 4.4 | 2026-07-11 | The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to in… |
CVE-2026-11591 | Medium | 4.4 | 2026-07-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3… |
CVE-2026-13378 | High | 7.2 | 2026-07-11 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up… |
CVE-2026-9738 | Medium | 4.4 | 2026-07-11 | The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versio… |
CVE-2026-15097 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versions up to, and includ… |
CVE-2026-15096 | Medium | 6.4 | 2026-07-11 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up to, and including… |
CVE-2026-12141 | Medium | 4.9 | 2026-07-11 | The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_to… |
CVE-2025-13968 | Medium | 6.4 | 2026-07-11 | The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-li… |
CVE-2026-5743 | Medium | 6.4 | 2026-07-11 | The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including… |
CVE-2026-3367 | Medium | 4.4 | 2026-07-11 | The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and i… |
CVE-2026-13114 | High | 7.2 | 2026-07-11 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biograp… |
CVE-2026-11913 | Critical | 9.8 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. |
CVE-2026-58591 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i… |
CVE-2026-58588 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-58587 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T… |
CVE-2026-55808 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-15085 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue… |
CVE-2026-15084 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS… |
CVE-2026-15082 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting… |
CVE-2026-13234 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2026-13231 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) all… |
CVE-2026-11908 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagif… |
CVE-2026-10770 | Medium | 6.1 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This… |
CVE-2026-10769 | Medium | 5.4 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affect… |
CVE-2026-57214 | Medium | 5.4 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML… |
CVE-2026-57213 | Medium | 4.8 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag f… |
CVE-2026-55879 | Critical | 9.3 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from… |
CVE-2026-55665 | | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker… | |
CVE-2026-55659 | High | 7.7 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into t… |
CVE-2026-55481 | Medium | 4.8 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS styl… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-54714 | Medium | 6.1 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and action… |
CVE-2026-55464 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, a… |
CVE-2025-30008 | Medium | 4.6 | 2026-07-10 | HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a… |
CVE-2026-56667 | High | 7.3 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.def… |
CVE-2026-55890 | Medium | 4.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leave… |
CVE-2026-3251 | Medium | 6.4 | 2026-07-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webremium Istanbul Web Design Mezunum Satiyorum allows St… |
CVE-2026-8595 | Medium | 6.8 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of an… |
CVE-2026-61492 | Low | 3.5 | 2026-07-10 | In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible |
CVE-2026-61456 | Medium | 4.6 | 2026-07-10 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUpload… |
CVE-2026-59795 | High | 8.1 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible |
CVE-2026-59794 | High | 7.3 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data |
CVE-2026-56354 | Medium | 4.1 | 2026-07-10 | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due… |
CVE-2026-29519 | High | 8.2 | 2026-07-10 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing t… |
CVE-2026-41877 | | 2026-07-10 | R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being up… | |
CVE-2026-13710 | Medium | 6.4 | 2026-07-10 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-13247 | Medium | 6.4 | 2026-07-10 | The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'l… |
CVE-2026-9838 | Medium | 6.1 | 2026-07-10 | The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12… |
CVE-2026-3907 | Medium | 6.4 | 2026-07-10 | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode in all versions up to and including 1.1.7. This… |
CVE-2026-12924 | Medium | 6.4 | 2026-07-10 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn… |
CVE-2026-12108 | Medium | 4.4 | 2026-07-10 | The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.0 du… |
CVE-2026-15301 | Medium | 6.4 | 2026-07-10 | The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and includi… |
CVE-2026-15299 | Medium | 6.4 | 2026-07-10 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weather_style' and 'move_direction' parameters of… |
CVE-2026-15298 | High | 7.2 | 2026-07-10 | The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient i… |
CVE-2026-15297 | Medium | 6.1 | 2026-07-10 | The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting vi… |
CVE-2026-15296 | Medium | 6.4 | 2026-07-10 | The affiliate-toolkit – WP Affiliate Plugin with Amazon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'atkp_product' short… |
CVE-2026-15292 | Medium | 6.4 | 2026-07-10 | The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background' parameter in the 'sudoku-sc' shortcode in all versi… |
CVE-2026-15285 | Medium | 6.4 | 2026-07-10 | The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_a… |