CWE-79 · Cross-site Scripting (page 3)
Page 3 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17209 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. |
CVE-2026-63361 | | 2026-08-14 | LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name… | |
CVE-2026-53472 | Medium | 6.3 | 2026-08-14 | A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malic… |
CVE-2026-72832 | Medium | 5.4 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Secur… |
CVE-2026-72821 | Medium | 5.4 | 2026-08-14 | Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw… |
CVE-2026-19794 | High | 7.2 | 2026-08-14 | The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitizatio… |
CVE-2026-14290 | Medium | 6.8 | 2026-08-14 | The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowin… |
CVE-2026-18109 | High | 7.2 | 2026-08-14 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due t… |
CVE-2026-73428 | Medium | 4.6 | 2026-08-13 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted H… |
CVE-2026-73417 | | 2026-08-13 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6… | |
CVE-2026-56858 | Medium | 6.1 | 2026-08-13 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. |
CVE-2026-18741 | Medium | 4.8 | 2026-08-13 | Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administr… |
CVE-2026-73531 | Medium | 6.1 | 2026-08-13 | django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submi… |
CVE-2026-49864 | | 2026-08-13 | wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape seq… | |
CVE-2026-73650 | High | 8.2 | 2026-08-13 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and… |
CVE-2026-73038 | Medium | 6.1 | 2026-08-13 | NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes… |
CVE-2026-73037 | Medium | 6.1 | 2026-08-13 | Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping i… |
CVE-2026-73648 | | 2026-08-13 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG ref… | |
CVE-2026-73572 | Medium | 6.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient san… |
CVE-2026-19744 | | 2026-08-13 | Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application… | |
CVE-2026-28154 | High | 7.1 | 2026-08-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPres… |
CVE-2026-73357 | Medium | 6.5 | 2026-08-13 | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. |
CVE-2026-73344 | Medium | 5.9 | 2026-08-13 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
CVE-2026-73340 | Medium | 6.5 | 2026-08-13 | Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. |
CVE-2026-66700 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. |
CVE-2026-66698 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. |
CVE-2026-66697 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. |
CVE-2026-66687 | Medium | 6.5 | 2026-08-13 | Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. |
CVE-2026-66655 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. |
CVE-2026-66471 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. |
CVE-2026-66468 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. |
CVE-2026-66467 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions. |
CVE-2026-66460 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions. |
CVE-2026-66456 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions. |
CVE-2026-66449 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. |
CVE-2026-66429 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. |
CVE-2026-66426 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. |
CVE-2026-65580 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. |
CVE-2026-61974 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. |
CVE-2026-61965 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions. |
CVE-2026-61960 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. |
CVE-2026-28187 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions. |
CVE-2026-28182 | Medium | 6.5 | 2026-08-13 | Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions. |
CVE-2026-28175 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. |
CVE-2026-28170 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions. |
CVE-2026-28158 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. |
CVE-2026-28004 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. |
CVE-2026-28003 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. |
CVE-2026-27539 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. |
CVE-2026-27537 | Medium | 6.5 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. |
CVE-2026-27536 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. |
CVE-2026-19716 | | 2026-08-13 | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary… | |
CVE-2026-73628 | Medium | 6.1 | 2026-08-13 | Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/fu… |
CVE-2026-3639 | Medium | 6.4 | 2026-08-13 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all version… |
CVE-2026-18146 | High | 7.2 | 2026-08-13 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-73492 | | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTM… | |
CVE-2026-73490 | Medium | 4.7 | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanit… |
CVE-2026-73427 | | 2026-08-12 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted applic… | |
CVE-2026-73422 | | 2026-08-12 | Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properti… | |
CVE-2026-73415 | | 2026-08-12 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in p… | |
CVE-2026-73329 | High | 8.7 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administr… |
CVE-2026-72787 | Medium | 6.4 | 2026-08-12 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding… |
CVE-2026-49466 | Medium | 6.5 | 2026-08-12 | Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the… |
CVE-2026-19657 | Medium | 6.1 | 2026-08-12 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafte… |
CVE-2026-18099 | High | 8.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled inp… |
CVE-2026-15217 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-15216 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-16627 | High | 7.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated… |
CVE-2026-73295 | Medium | 5.4 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/asse… |
CVE-2026-48552 | Medium | 5.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflecte… |
CVE-2026-48550 | Medium | 6.1 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthentic… |
CVE-2026-16694 | Medium | 6.4 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code i… |
CVE-2026-65937 | High | 8.0 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content. |
CVE-2026-73374 | | 2026-08-12 | A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associat… | |
CVE-2026-73262 | Medium | 5.4 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, asse… |
CVE-2026-57858 | High | 8.9 | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticat… |
CVE-2026-70560 | Medium | 5.4 | 2026-08-12 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inje… |
CVE-2026-19217 | Medium | 5.4 | 2026-08-12 | The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-16066 | Medium | 5.4 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi… |
CVE-2026-15249 | Medium | 5.4 | 2026-08-12 | The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a… |
CVE-2026-9318 | Medium | 5.4 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScr… |
CVE-2026-73031 | High | 8.7 | 2026-08-11 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sendi… |
CVE-2026-66146 | Medium | 6.1 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute… |
CVE-2026-48414 | High | 7.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48413 | High | 8.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-73084 | Medium | 6.1 | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query… |
CVE-2026-71386 | High | 8.8 | 2026-08-11 | is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e… |
CVE-2026-70355 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70306 | Critical | 9.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-65767 | High | 8.8 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform sp… |
CVE-2026-64922 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64916 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64902 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64900 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64897 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-62914 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoo… |
CVE-2026-62829 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-57105 | High | 8.0 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-57104 | High | 8.8 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privi… |