CWE-79 · Cross-site Scripting (page 30)
Page 30 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4333 | Medium | 6.4 | 2026-04-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses sho… |
CVE-2026-3600 | Medium | 6.4 | 2026-04-08 | The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribu… |
CVE-2026-3513 | Medium | 6.4 | 2026-04-08 | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all vers… |
CVE-2026-3239 | Medium | 6.4 | 2026-04-08 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, an… |
CVE-2026-4379 | Medium | 6.4 | 2026-04-08 | The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all version… |
CVE-2026-2988 | Medium | 6.4 | 2026-04-08 | The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and i… |
CVE-2026-32289 | Medium | 6.1 | 2026-04-08 | Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used… |
CVE-2026-4406 | Medium | 4.7 | 2026-04-08 | The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in the `gform_get_config` AJAX action in al… |
CVE-2026-4394 | Medium | 6.1 | 2026-04-08 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field (`input_<id>.4`) in all v… |
CVE-2026-39936 | | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allo… | |
CVE-2026-39935 | | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Exten… | |
CVE-2026-39933 | | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Exte… | |
CVE-2026-39846 | Critical | 9.0 | 2026-04-07 | SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Elect… |
CVE-2026-39400 | Medium | 6.1 | 2026-04-07 | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privi… |
CVE-2026-32712 | Medium | 5.4 | 2026-04-07 | Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (X… |
CVE-2026-39841 | Medium | 6.1 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored X… |
CVE-2026-39840 | Medium | 6.1 | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows X… |
CVE-2026-39838 | | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension… | |
CVE-2026-39380 | Medium | 5.4 | 2026-04-07 | Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (X… |
CVE-2026-39367 | Medium | 5.4 | 2026-04-07 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs… |
CVE-2026-39344 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is… |
CVE-2026-39338 | Medium | 6.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accep… |
CVE-2026-39336 | Medium | 6.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from co… |
CVE-2026-39335 | Medium | 6.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is prim… |
CVE-2026-39333 | High | 8.7 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into… |
CVE-2026-39332 | High | 8.7 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authentica… |
CVE-2026-39328 | High | 8.9 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing… |
CVE-2026-35576 | High | 8.7 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person P… |
CVE-2026-35575 | High | 8.0 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creat… |
CVE-2026-35608 | Medium | 6.1 | 2026-04-07 | QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SV… |
CVE-2026-35574 | High | 7.3 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authe… |
CVE-2026-35571 | Medium | 4.8 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly… |
CVE-2026-35534 | High | 7.6 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use… |
CVE-2026-35460 | Medium | 4.3 | 2026-04-07 | Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into… |
CVE-2026-3466 | Medium | 5.4 | 2026-04-07 | Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2… |
CVE-2026-33865 | Medium | 5.4 | 2026-04-07 | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attac… |
CVE-2026-4420 | Medium | 5.4 | 2026-04-07 | Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as… |
CVE-2026-5705 | Medium | 4.3 | 2026-04-07 | A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php o… |
CVE-2026-22675 | Medium | 5.4 | 2026-04-06 | OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary… |
CVE-2026-35399 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup… |
CVE-2026-35390 | Medium | 5.4 | 2026-04-06 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-… |
CVE-2026-35208 | Medium | 5.4 | 2026-04-06 | lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live str… |
CVE-2026-5671 | Medium | 4.3 | 2026-04-06 | A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Impacted is an unknown function of the fi… |
CVE-2026-35166 | Medium | 5.4 | 2026-04-06 | Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo u… |
CVE-2026-35052 | Critical | 9.8 | 2026-04-06 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly wh… |
CVE-2026-35046 | Medium | 5.4 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users… |
CVE-2026-5668 | Low | 2.4 | 2026-04-06 | A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Ad… |
CVE-2026-35035 | High | 7.2 | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0… |
CVE-2026-34989 | Critical | 9.0 | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0… |
CVE-2026-31313 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web s… |
CVE-2026-34951 | Medium | 6.1 | 2026-04-06 | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbenc… |
CVE-2026-33405 | Low | 3.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the form… |
CVE-2026-31354 | Medium | 5.4 | 2026-04-06 | Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary we… |
CVE-2026-31353 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts o… |
CVE-2026-31352 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web sc… |
CVE-2026-31351 | Medium | 4.8 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web s… |
CVE-2026-31350 | Medium | 5.4 | 2026-04-06 | An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2026-34897 | Medium | 6.5 | 2026-04-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.T… |
CVE-2026-33406 | Medium | 5.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configur… |
CVE-2026-33404 | Low | 3.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client h… |
CVE-2026-33403 | Medium | 6.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflec… |
CVE-2026-31153 | Medium | 5.4 | 2026-04-06 | A stored cross-site scripting (XSS) vulnerability in Bynder v0.1.394 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2026-26027 | High | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory e… |
CVE-2026-25932 | High | 7.2 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier f… |
CVE-2026-5647 | Low | 2.4 | 2026-04-06 | A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Pro… |
CVE-2026-5644 | Low | 2.4 | 2026-04-06 | A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of t… |
CVE-2026-5643 | Low | 2.4 | 2026-04-06 | A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the f… |
CVE-2026-5630 | Medium | 4.3 | 2026-04-06 | A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component… |
CVE-2026-5625 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/research… |
CVE-2026-5615 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload E… |
CVE-2019-25676 | High | 8.2 | 2026-04-05 | Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipu… |
CVE-2026-5568 | Low | 3.5 | 2026-04-05 | A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the… |
CVE-2026-5542 | Medium | 4.3 | 2026-04-05 | A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Param… |
CVE-2026-5541 | Medium | 4.3 | 2026-04-05 | A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the componen… |
CVE-2026-5539 | Medium | 4.3 | 2026-04-05 | A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler… |
CVE-2026-5533 | Medium | 4.3 | 2026-04-05 | A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtif… |
CVE-2016-20054 | Medium | 4.3 | 2026-04-04 | Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. At… |
CVE-2018-25250 | High | 7.2 | 2026-04-04 | MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by cr… |
CVE-2018-25249 | Medium | 6.4 | 2026-04-04 | MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade g… |
CVE-2018-25248 | High | 7.2 | 2026-04-04 | MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the downlo… |
CVE-2018-25247 | Medium | 6.1 | 2026-04-04 | MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; w… |
CVE-2026-2936 | High | 7.2 | 2026-04-04 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to… |
CVE-2026-0626 | Medium | 6.4 | 2026-04-04 | The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-5425 | High | 7.2 | 2026-04-04 | The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, a… |
CVE-2026-2437 | Medium | 6.4 | 2026-04-04 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_tri… |
CVE-2026-2600 | Medium | 6.4 | 2026-04-04 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simp… |
CVE-2026-0738 | Medium | 6.4 | 2026-04-04 | The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions… |
CVE-2026-0737 | Medium | 6.4 | 2026-04-04 | The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. T… |
CVE-2026-0664 | Medium | 6.4 | 2026-04-04 | The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and inc… |
CVE-2026-0552 | Medium | 6.4 | 2026-04-04 | The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up… |
CVE-2025-15064 | Medium | 6.4 | 2026-04-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-13368 | Medium | 6.4 | 2026-04-04 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting… |
CVE-2026-2949 | Medium | 6.4 | 2026-04-04 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and i… |
CVE-2026-2924 | Medium | 6.4 | 2026-04-04 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' paramet… |
CVE-2026-34229 | Medium | 6.1 | 2026-04-03 | Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via… |
CVE-2026-35218 | High | 8.7 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automat… |
CVE-2026-5468 | Low | 3.5 | 2026-04-03 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/fo… |
CVE-2026-27655 | High | 7.3 | 2026-04-03 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report. |
CVE-2026-4108 | High | 7.3 | 2026-04-03 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report. |
CVE-2026-4107 | High | 7.3 | 2026-04-03 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report. |