CWE-79 · Cross-site Scripting (page 3)
Page 3 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-105089 | High | 8.7 | 2026-10-04 | WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a maliciou… |
CVE-2026-105086 | High | 8.7 | 2026-10-04 | WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-en… |
CVE-2026-97276 | High | 7.1 | 2026-10-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected X… |
CVE-2026-103354 | High | 7.1 | 2026-10-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks… |
CVE-2026-103344 | High | 7.1 | 2026-10-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free… |
CVE-2026-103062 | High | 7.1 | 2026-10-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual all… |
CVE-2026-17005 | Medium | 6.8 | 2026-10-04 | The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an… |
CVE-2026-104119 | Low | 3.5 | 2026-10-04 | The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allo… |
CVE-2026-105099 | Low | 3.5 | 2026-10-04 | A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the… |
CVE-2026-105124 | Medium | 6.1 | 2026-10-04 | W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the lo… |
CVE-2026-103342 | High | 7.1 | 2026-10-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free… |
CVE-2026-105116 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer co… |
CVE-2026-105114 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parame… |
CVE-2026-92767 | Medium | 6.4 | 2026-10-03 | The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and i… |
CVE-2026-97660 | High | 7.2 | 2026-10-03 | The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all… |
CVE-2026-93896 | Medium | 6.1 | 2026-10-03 | The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the d… |
CVE-2026-93889 | High | 7.2 | 2026-10-03 | The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versio… |
CVE-2026-92974 | Medium | 6.1 | 2026-10-03 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter i… |
CVE-2026-15795 | Medium | 6.4 | 2026-10-03 | The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all ver… |
CVE-2026-104313 | Medium | 6.1 | 2026-10-03 | The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versi… |
CVE-2026-103421 | Medium | 5.4 | 2026-10-03 | The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /andr… |
CVE-2026-97344 | Medium | 6.4 | 2026-10-03 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User M… |
CVE-2026-97341 | High | 7.2 | 2026-10-03 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all version… |
CVE-2026-96650 | High | 7.2 | 2026-10-03 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and inc… |
CVE-2026-96575 | High | 7.2 | 2026-10-03 | The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Pr… |
CVE-2026-96564 | High | 7.2 | 2026-10-03 | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and… |
CVE-2026-94239 | Medium | 6.8 | 2026-10-03 | The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, al… |
CVE-2026-93430 | High | 7.2 | 2026-10-03 | The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all vers… |
CVE-2026-88783 | High | 8.8 | 2026-10-03 | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is app… |
CVE-2026-88782 | Medium | 6.8 | 2026-10-03 | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowi… |
CVE-2026-87091 | High | 7.2 | 2026-10-03 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and incl… |
CVE-2026-80517 | Low | 3.5 | 2026-10-03 | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content… |
CVE-2026-103909 | Medium | 6.1 | 2026-10-03 | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cro… |
CVE-2026-103888 | Medium | 6.1 | 2026-10-03 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all version… |
CVE-2026-101928 | High | 7.2 | 2026-10-03 | The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and i… |
CVE-2026-101357 | Medium | 4.9 | 2026-10-03 | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' para… |
CVE-2026-101162 | Medium | 6.4 | 2026-10-03 | The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow us… |
CVE-2026-101159 | High | 7.5 | 2026-10-03 | The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available… |
CVE-2026-100148 | Medium | 6.4 | 2026-10-03 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to… |
CVE-2025-12828 | Medium | 6.4 | 2026-10-03 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and includ… |
CVE-2026-92977 | High | 7.2 | 2026-10-03 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and… |
CVE-2026-92826 | Medium | 6.1 | 2026-10-03 | The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and includin… |
CVE-2026-92727 | Medium | 6.4 | 2026-10-03 | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross… |
CVE-2026-92551 | Medium | 6.1 | 2026-10-03 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2026-92538 | Medium | 6.1 | 2026-10-03 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the… |
CVE-2026-96270 | High | 7.2 | 2026-10-03 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-94378 | Medium | 6.4 | 2026-10-03 | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' para… |
CVE-2026-92243 | Medium | 6.1 | 2026-10-03 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, an… |
CVE-2026-100180 | Medium | 5.4 | 2026-10-03 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-104479 | Medium | 5.4 | 2026-10-03 | Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing des… |
CVE-2026-104477 | Medium | 6.1 | 2026-10-03 | Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destinati… |
CVE-2026-104475 | Medium | 5.4 | 2026-10-03 | IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SV… |
CVE-2026-102626 | | 2026-10-02 | An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attri… | |
CVE-2026-104907 | | 2026-10-02 | MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview… | |
CVE-2026-104906 | | 2026-10-02 | MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properti… | |
CVE-2026-104901 | | 2026-10-02 | MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked… | |
CVE-2026-104900 | | 2026-10-02 | MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the… | |
CVE-2026-104847 | | 2026-10-02 | ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling acc… | |
CVE-2026-5782 | Medium | 5.2 | 2026-10-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows… |
CVE-2026-93875 | High | 7.2 | 2026-10-02 | The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5… |
CVE-2026-104612 | Medium | 4.3 | 2026-10-02 | A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcemen… |
CVE-2026-102798 | Medium | 6.5 | 2026-10-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored X… |
CVE-2026-104473 | Medium | 6.1 | 2026-10-02 | YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized para… |
CVE-2026-104466 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inje… |
CVE-2026-104465 | Medium | 6.1 | 2026-10-02 | YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of… |
CVE-2026-104461 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never ca… |
CVE-2026-104450 | Medium | 6.5 | 2026-10-02 | YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-c… |
CVE-2026-104414 | High | 8.1 | 2026-10-02 | Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEm… |
CVE-2026-104413 | High | 7.3 | 2026-10-02 | Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by… |
CVE-2026-104411 | High | 7.3 | 2026-10-02 | Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with ext… |
CVE-2026-59668 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59667 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59666 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-97652 | Medium | 6.1 | 2026-10-02 | The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI… |
CVE-2026-95662 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-87920 | High | 7.2 | 2026-10-02 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to… |
CVE-2026-85492 | Medium | 6.1 | 2026-10-02 | The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based… |
CVE-2026-59673 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59672 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59665 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59664 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59663 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59662 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59661 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59660 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59659 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59671 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59670 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-59669 | | 2026-10-02 | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execu… | |
CVE-2026-97663 | High | 7.2 | 2026-10-02 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and inclu… |
CVE-2026-97641 | High | 7.2 | 2026-10-02 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4… |
CVE-2026-97342 | High | 7.2 | 2026-10-02 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Pos… |
CVE-2026-97338 | Medium | 6.4 | 2026-10-02 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to ins… |
CVE-2026-97336 | High | 7.2 | 2026-10-02 | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insuf… |
CVE-2026-96871 | High | 7.2 | 2026-10-02 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due… |
CVE-2026-96647 | Medium | 6.4 | 2026-10-02 | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Pa… |
CVE-2026-96578 | High | 7.2 | 2026-10-02 | The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to… |
CVE-2026-96567 | High | 7.2 | 2026-10-02 | The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to… |
CVE-2026-96566 | High | 7.2 | 2026-10-02 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all v… |
CVE-2026-95817 | High | 7.2 | 2026-10-02 | The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due… |