CWE-79 · Cross-site Scripting (page 29)
Page 29 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15284 | Medium | 6.4 | 2026-07-10 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and includi… |
CVE-2026-15283 | Medium | 4.4 | 2026-07-10 | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33… |
CVE-2026-15321 | Low | 2.4 | 2026-07-10 | A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend… |
CVE-2026-11392 | Medium | 6.1 | 2026-07-10 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versio… |
CVE-2026-15311 | Low | 3.5 | 2026-07-10 | A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the fi… |
CVE-2026-59833 | | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with san… | |
CVE-2026-58144 | Medium | 5.4 | 2026-07-09 | Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary scrip… |
CVE-2026-55424 | Medium | 5.4 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized a… |
CVE-2026-53963 | High | 7.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled… |
CVE-2026-53962 | Medium | 5.4 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar h… |
CVE-2026-60120 | Medium | 5.4 | 2026-07-09 | Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute a… |
CVE-2026-54002 | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize()… | |
CVE-2026-0279 | Medium | 6.1 | 2026-07-09 | Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Cl… |
CVE-2026-15202 | Medium | 4.3 | 2026-07-09 | A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler… |
CVE-2026-59214 | High | 7.3 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a sam… |
CVE-2026-53987 | Medium | 6.4 | 2026-07-09 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanC… |
CVE-2026-5005 | Medium | 5.4 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics Technology Consulting, Trade and Educa… |
CVE-2026-9253 | High | 7.2 | 2026-07-09 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter… |
CVE-2026-13441 | High | 7.2 | 2026-07-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_col… |
CVE-2026-5793 | Medium | 6.1 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows R… |
CVE-2026-2342 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Store… |
CVE-2026-6910 | Medium | 6.4 | 2026-07-09 | The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_produc… |
CVE-2026-4653 | Medium | 6.4 | 2026-07-09 | The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and incl… |
CVE-2026-31981 | Medium | 5.9 | 2026-07-09 | A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restricti… |
CVE-2026-15000 | High | 7.2 | 2026-07-09 | The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up… |
CVE-2026-14343 | Medium | 6.4 | 2026-07-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions… |
CVE-2026-13771 | Medium | 6.4 | 2026-07-09 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, a… |
CVE-2026-13334 | Medium | 6.1 | 2026-07-09 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due… |
CVE-2026-13253 | Medium | 6.4 | 2026-07-09 | The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-sea… |
CVE-2026-12170 | Medium | 6.4 | 2026-07-09 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-47646 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform… |
CVE-2026-15128 | Medium | 6.1 | 2026-07-08 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craft… |
CVE-2026-15127 | Medium | 6.1 | 2026-07-08 | Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craft… |
CVE-2026-5922 | | 2026-07-08 | The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage. | |
CVE-2026-55877 | Medium | 6.1 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html']… |
CVE-2026-6896 | High | 8.7 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain con… |
CVE-2026-58191 | Medium | 6.5 | 2026-07-08 | Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver uncond… |
CVE-2026-55596 | High | 8.7 | 2026-07-08 | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMe… |
CVE-2026-54527 | Critical | 9.0 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to inne… |
CVE-2026-13320 | High | 7.3 | 2026-07-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain c… |
CVE-2026-59929 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, v… |
CVE-2026-59926 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Ad… |
CVE-2026-59923 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowin… |
CVE-2026-59895 | Medium | 6.1 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from pla… |
CVE-2026-57439 | Medium | 5.0 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while p… |
CVE-2026-11903 | High | 8.0 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue aff… |
CVE-2026-60092 | Medium | 6.1 | 2026-07-08 | AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetI… |
CVE-2026-58657 | Medium | 4.8 | 2026-07-08 | Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. P… |
CVE-2026-56359 | Medium | 5.4 | 2026-07-08 | n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs… |
CVE-2026-56283 | Medium | 5.4 | 2026-07-08 | Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. At… |
CVE-2026-41122 | High | 7.1 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-8315 | Medium | 5.4 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS. This… |
CVE-2026-8310 | Medium | 6.1 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Reflected XSS. Th… |
CVE-2026-6820 | High | 7.2 | 2026-07-08 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, an… |
CVE-2026-6740 | Medium | 6.4 | 2026-07-08 | The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon'… |
CVE-2026-6459 | Medium | 6.4 | 2026-07-08 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Cale… |
CVE-2026-6818 | High | 7.2 | 2026-07-08 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all version… |
CVE-2026-6742 | Medium | 6.4 | 2026-07-08 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026… |
CVE-2026-6371 | Medium | 4.8 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Limatek System Inc. LimRAD NAC allows Stored XSS. This i… |
CVE-2025-14785 | Medium | 6.4 | 2026-07-08 | The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Si… |
CVE-2026-12041 | Medium | 4.4 | 2026-07-08 | The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inc… |
CVE-2026-11798 | Medium | 6.1 | 2026-07-08 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heat… |
CVE-2026-10570 | Medium | 6.4 | 2026-07-08 | The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to… |
CVE-2026-55437 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine… |
CVE-2026-36163 | Medium | 5.4 | 2026-07-07 | An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context o… |
CVE-2026-36162 | Medium | 5.4 | 2026-07-07 | An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Java… |
CVE-2026-55647 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html wi… | |
CVE-2026-55592 | Low | 3.9 | 2026-07-07 | Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source… |
CVE-2026-48954 | Medium | 6.1 | 2026-07-07 | Improper validation leads to a generic XSS vector in the language override feature. |
CVE-2026-48953 | Medium | 6.1 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. |
CVE-2026-48952 | Medium | 6.1 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. |
CVE-2026-48951 | Medium | 6.1 | 2026-07-07 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. |
CVE-2026-48950 | Medium | 6.1 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. |
CVE-2026-48949 | Medium | 6.1 | 2026-07-07 | Lack of validation leads to an XSS vulnerability in the MFA management views. |
CVE-2025-12799 | Medium | 6.5 | 2026-07-07 | A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters i… |
CVE-2026-12948 | | 2026-07-07 | A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allow… | |
CVE-2026-8309 | Medium | 5.4 | 2026-07-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S… |
CVE-2026-8306 | Medium | 6.1 | 2026-07-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S… |
CVE-2026-11328 | Medium | 6.4 | 2026-07-07 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and in… |
CVE-2026-53641 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in… | |
CVE-2026-59710 | Medium | 6.1 | 2026-07-06 | showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape t… |
CVE-2026-59711 | Medium | 6.1 | 2026-07-06 | showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeH… |
CVE-2026-58402 | Medium | 5.4 | 2026-07-06 | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the c… |
CVE-2026-50133 | Medium | 6.1 | 2026-07-06 | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .h… |
CVE-2026-12154 | Medium | 6.4 | 2026-07-06 | The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of t… |
CVE-2025-53831 | High | 8.2 | 2026-07-06 | DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud… |
CVE-2025-8591 | Medium | 6.1 | 2026-07-06 | The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition a… |
CVE-2026-14791 | Low | 3.5 | 2026-07-06 | A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesReq… |
CVE-2026-14752 | Low | 3.5 | 2026-07-05 | A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of t… |
CVE-2026-14704 | Medium | 4.3 | 2026-07-05 | A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the… |
CVE-2026-14656 | Medium | 4.3 | 2026-07-04 | A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The man… |
CVE-2026-14655 | Low | 2.4 | 2026-07-04 | A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.ph… |
CVE-2026-14634 | Medium | 4.3 | 2026-07-04 | A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the fu… |
CVE-2026-14633 | Medium | 4.3 | 2026-07-04 | A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of t… |
CVE-2026-58524 | Medium | 5.4 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-58298 | High | 7.2 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-57977 | High | 7.1 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-28737 | High | 8.7 | 2026-07-03 | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. |
CVE-2026-4322 | Medium | 6.1 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency… |
CVE-2026-9756 | Medium | 6.4 | 2026-07-03 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versi… |