CWE-79 · Cross-site Scripting (page 30)
Page 30 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9756 | Medium | 6.4 | 2026-07-03 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versi… |
CVE-2026-4804 | Medium | 6.4 | 2026-07-03 | The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the… |
CVE-2026-9148 | High | 7.2 | 2026-07-03 | The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and includ… |
CVE-2026-8351 | Medium | 6.4 | 2026-07-03 | The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, a… |
CVE-2026-9626 | Medium | 6.4 | 2026-07-03 | The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up… |
CVE-2026-8892 | Medium | 6.4 | 2026-07-03 | The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fi… |
CVE-2026-8489 | Medium | 6.4 | 2026-07-03 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-13040 | High | 7.2 | 2026-07-03 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all ver… |
CVE-2026-12734 | Medium | 6.4 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorW… |
CVE-2026-12731 | Medium | 6.4 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTit… |
CVE-2026-13377 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Sto… |
CVE-2026-13376 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows S… |
CVE-2026-13375 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integr… |
CVE-2026-13374 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Int… |
CVE-2026-13373 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integr… |
CVE-2026-59102 | Medium | 5.4 | 2026-07-02 | Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users'… |
CVE-2026-58579 | Medium | 5.4 | 2026-07-02 | RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl… |
CVE-2025-71385 | Medium | 6.1 | 2026-07-02 | Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG doc… |
CVE-2026-8699 | | 2026-07-02 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient serv… | |
CVE-2026-4772 | Medium | 5.4 | 2026-07-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Stored XSS. This… |
CVE-2026-4770 | Medium | 4.6 | 2026-07-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows… |
CVE-2026-57764 | Medium | 6.5 | 2026-07-02 | Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions. |
CVE-2026-57763 | Medium | 6.5 | 2026-07-02 | Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions. |
CVE-2026-57762 | Medium | 5.9 | 2026-07-02 | Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions. |
CVE-2026-57755 | Medium | 6.5 | 2026-07-02 | Contributor Cross Site Scripting (XSS) in Mosaic Gallery – Advanced Gallery <= 1.2.0 versions. |
CVE-2026-57754 | Medium | 6.5 | 2026-07-02 | Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions. |
CVE-2026-57686 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions. |
CVE-2026-57684 | Medium | 6.5 | 2026-07-02 | Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions. |
CVE-2026-57682 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions. |
CVE-2026-57678 | High | 7.1 | 2026-07-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This… |
CVE-2026-57675 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions. |
CVE-2026-57674 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions. |
CVE-2026-57673 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions. |
CVE-2026-57672 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions. |
CVE-2026-57671 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions. |
CVE-2026-57670 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions. |
CVE-2026-57625 | Critical | 9.6 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions. |
CVE-2026-57426 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions. |
CVE-2026-57366 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions. |
CVE-2026-57362 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions. |
CVE-2026-57361 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions. |
CVE-2026-57360 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions. |
CVE-2026-57359 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions. |
CVE-2026-57358 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions. |
CVE-2026-57357 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions. |
CVE-2026-57356 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. |
CVE-2026-57354 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. |
CVE-2026-57351 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. |
CVE-2026-57350 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. |
CVE-2026-57349 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions. |
CVE-2026-57345 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. |
CVE-2026-57344 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. |
CVE-2026-57343 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-57342 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. |
CVE-2026-27430 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. |
CVE-2026-27426 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions. |
CVE-2026-27425 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. |
CVE-2026-27408 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions. |
CVE-2026-27404 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. |
CVE-2026-27402 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions. |
CVE-2026-14449 | | 2026-07-02 | u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components | |
CVE-2025-69156 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. |
CVE-2025-69155 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. |
CVE-2025-69154 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. |
CVE-2025-69153 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. |
CVE-2025-69152 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. |
CVE-2026-13252 | Medium | 6.4 | 2026-07-02 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2026-10104 | Medium | 4.4 | 2026-07-02 | The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up t… |
CVE-2026-13704 | Medium | 6.4 | 2026-07-02 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]'… |
CVE-2026-10089 | Medium | 6.4 | 2026-07-02 | The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and inclu… |
CVE-2026-55791 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… | |
CVE-2026-55790 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can… | |
CVE-2026-55793 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript paylo… | |
CVE-2026-54263 | High | 7.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerab… |
CVE-2026-58263 | High | 7.2 | 2026-07-01 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed b… |
CVE-2026-55661 | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image rendere… | |
CVE-2026-55660 | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-… | |
CVE-2026-54720 | Medium | 5.4 | 2026-07-01 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS i… |
CVE-2026-14358 | Medium | 6.1 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension all… |
CVE-2026-57737 | Medium | 6.5 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme… |
CVE-2026-57722 | Medium | 5.9 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This… |
CVE-2026-34098 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129)… |
CVE-2026-34097 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101… |
CVE-2026-34096 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authent… |
CVE-2026-58038 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerabilit… |
CVE-2026-58037 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58032 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58030 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This… |
CVE-2026-58028 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2026-6283 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5220 | Medium | 6.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-58035 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58034 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerabili… |
CVE-2026-58031 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-53907 | Medium | 5.4 | 2026-07-01 | MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application lo… |
CVE-2026-13323 | Medium | 4.1 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Poli… |
CVE-2026-12142 | High | 7.2 | 2026-07-01 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all vers… |
CVE-2026-10095 | Medium | 6.4 | 2026-07-01 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1… |
CVE-2026-12754 | Medium | 6.1 | 2026-07-01 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions… |
CVE-2026-13733 | Medium | 6.4 | 2026-07-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and includi… |