CWE-79 · Cross-site Scripting (page 31)
Page 31 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12732 | Medium | 6.4 | 2026-07-01 | The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and includ… |
CVE-2026-9107 | Medium | 6.4 | 2026-07-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component… |
CVE-2026-7517 | High | 7.2 | 2026-07-01 | The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in al… |
CVE-2026-58519 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-2387 | Medium | 6.4 | 2026-07-01 | The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_even… |
CVE-2026-13731 | High | 7.2 | 2026-07-01 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation'… |
CVE-2026-13443 | Medium | 6.4 | 2026-07-01 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versi… |
CVE-2026-13246 | Medium | 6.4 | 2026-07-01 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcod… |
CVE-2026-13015 | Medium | 6.1 | 2026-07-01 | The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and includ… |
CVE-2026-12135 | Medium | 6.4 | 2026-07-01 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all vers… |
CVE-2026-11380 | Medium | 6.4 | 2026-07-01 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insuffici… |
CVE-2026-57963 | Medium | 6.5 | 2026-07-01 | An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Thi… |
CVE-2026-56356 | Medium | 5.4 | 2026-06-30 | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Af… |
CVE-2026-50040 | Medium | 6.1 | 2026-06-30 | Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker c… |
CVE-2026-14147 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-14145 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-14068 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2026-14001 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-14000 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-13977 | Medium | 5.4 | 2026-06-30 | Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a c… |
CVE-2026-13957 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to inject… |
CVE-2026-13836 | Medium | 6.1 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-10585 | Medium | 5.4 | 2026-06-30 | A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript i… |
CVE-2026-11594 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. |
CVE-2025-36323 | Medium | 5.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr… |
CVE-2025-36320 | Medium | 6.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2026-11712 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
CVE-2026-11708 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
CVE-2026-10513 | High | 7.2 | 2026-06-30 | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' au… |
CVE-2026-58371 | Low | 3.1 | 2026-06-30 | SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson hel… |
CVE-2026-48307 | High | 8.8 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabil… |
CVE-2026-8403 | Medium | 6.1 | 2026-06-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-52760 | Medium | 6.1 | 2026-06-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse… |
CVE-2026-8141 | High | 7.2 | 2026-06-30 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up… |
CVE-2026-6954 | | 2026-06-30 | Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dy… | |
CVE-2026-6953 | | 2026-06-30 | HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a… | |
CVE-2026-56809 | Medium | 6.1 | 2026-06-30 | Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An ar… |
CVE-2026-12560 | Medium | 4.4 | 2026-06-30 | The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up… |
CVE-2026-12114 | Medium | 4.4 | 2026-06-30 | The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2026-54889 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Qu… | |
CVE-2026-53427 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scri… | |
CVE-2026-57958 | Medium | 6.1 | 2026-06-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenti… |
CVE-2026-57338 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
CVE-2026-57337 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions. |
CVE-2026-57336 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. |
CVE-2026-57333 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. |
CVE-2026-57330 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. |
CVE-2026-57329 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions. |
CVE-2026-57328 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57326 | Medium | 6.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57320 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. |
CVE-2026-13570 | Low | 3.5 | 2026-06-29 | A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the compo… |
CVE-2026-13567 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component PO… |
CVE-2026-13558 | Low | 3.5 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of t… |
CVE-2026-13557 | Medium | 4.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/mod_room/controll… |
CVE-2026-13556 | Medium | 4.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?act… |
CVE-2026-13554 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2026-13536 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn lea… |
CVE-2026-13504 | Low | 3.5 | 2026-06-28 | A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component M… |
CVE-2026-13499 | Medium | 4.3 | 2026-06-28 | A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file login_register.php of the co… |
CVE-2026-13295 | Medium | 6.4 | 2026-06-27 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including… |
CVE-2026-12399 | Medium | 4.4 | 2026-06-27 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… |
CVE-2026-11783 | Medium | 6.4 | 2026-06-27 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2026-11597 | Medium | 6.4 | 2026-06-27 | The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to… |
CVE-2026-13245 | Medium | 6.1 | 2026-06-27 | The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and includ… |
CVE-2026-13335 | Medium | 6.4 | 2026-06-27 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and… |
CVE-2026-11356 | Medium | 4.4 | 2026-06-27 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settin… |
CVE-2026-50767 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an auth… |
CVE-2026-50766 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticate… |
CVE-2026-50765 | Medium | 6.1 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions… |
CVE-2026-52781 | Medium | 6.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* a… |
CVE-2026-44696 | Medium | 5.7 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config… |
CVE-2026-57656 | Medium | 5.9 | 2026-06-26 | Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions. |
CVE-2026-57651 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions. |
CVE-2026-57650 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. |
CVE-2026-57638 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. |
CVE-2026-57629 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions. |
CVE-2026-57618 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions. |
CVE-2026-57617 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions. |
CVE-2026-57431 | Medium | 6.5 | 2026-06-26 | Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions. |
CVE-2026-57325 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. |
CVE-2026-57322 | High | 7.1 | 2026-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affe… |
CVE-2026-57319 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. |
CVE-2026-57317 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions. |
CVE-2026-57314 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions. |
CVE-2026-57313 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions. |
CVE-2026-57312 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. |
CVE-2026-56072 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. |
CVE-2026-56047 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions. |
CVE-2026-56046 | Medium | 6.5 | 2026-06-26 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. |
CVE-2026-56045 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. |
CVE-2026-56044 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. |
CVE-2026-56043 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions. |
CVE-2026-56041 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions. |
CVE-2026-56040 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions. |
CVE-2026-56039 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions. |
CVE-2026-56011 | High | 7.1 | 2026-06-26 | Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions. |
CVE-2025-68075 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions. |
CVE-2025-68074 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions. |
CVE-2026-57620 | Medium | 6.5 | 2026-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS… |