CWE-79 · Cross-site Scripting (page 33)
Page 33 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11943 | | 2026-06-22 | Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authen… | |
CVE-2026-11942 | | 2026-06-22 | Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create… | |
CVE-2026-11372 | Medium | 5.4 | 2026-06-22 | IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary… |
CVE-2026-9029 | High | 7.3 | 2026-06-22 | A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script the… |
CVE-2025-33128 | Medium | 5.4 | 2026-06-22 | IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulner… |
CVE-2026-12580 | Medium | 5.4 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript cod… |
CVE-2023-45796 | High | 8.1 | 2026-06-22 | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-priv… |
CVE-2023-45795 | High | 7.8 | 2026-06-22 | A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascr… |
CVE-2026-6858 | High | 7.1 | 2026-06-22 | The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS att… |
CVE-2026-4259 | High | 7.1 | 2026-06-22 | The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to… |
CVE-2026-12811 | Medium | 4.3 | 2026-06-21 | A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/… |
CVE-2026-56397 | Critical | 9.6 | 2026-06-21 | SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HT… |
CVE-2026-56393 | Medium | 4.8 | 2026-06-21 | Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where setting… |
CVE-2026-56383 | Medium | 4.8 | 2026-06-21 | Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The applicat… |
CVE-2026-56381 | Medium | 4.8 | 2026-06-21 | Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without… |
CVE-2026-56347 | Medium | 6.1 | 2026-06-20 | AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon c… |
CVE-2026-56317 | Medium | 6.1 | 2026-06-20 | Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerH… |
CVE-2026-32208 | High | 8.8 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing ov… |
CVE-2026-12621 | Medium | 5.4 | 2026-06-19 | Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridT… |
CVE-2026-12619 | Medium | 5.4 | 2026-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scriptin… |
CVE-2026-21768 | Medium | 6.3 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby all… |
CVE-2026-8296 | | 2026-06-19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. | |
CVE-2026-1856 | Medium | 6.4 | 2026-06-19 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking field labels in all versions up to, and i… |
CVE-2026-12430 | Medium | 4.4 | 2026-06-19 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to… |
CVE-2026-12157 | Medium | 6.4 | 2026-06-19 | The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bloc… |
CVE-2026-12048 | Critical | 9.3 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, includi… |
CVE-2026-12047 | Low | 3.5 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and… |
CVE-2026-22674 | Medium | 4.8 | 2026-06-18 | Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDA… |
CVE-2026-43915 | Medium | 5.4 | 2026-06-18 | Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the… |
CVE-2026-11982 | | 2026-06-18 | Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow. | |
CVE-2026-56009 | Medium | 5.9 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This is… |
CVE-2026-56007 | Medium | 5.9 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This is… |
CVE-2026-54221 | | 2026-06-18 | UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling attackers to execute arbitrary JavaScri… | |
CVE-2026-54219 | | 2026-06-18 | UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged… | |
CVE-2026-40457 | | 2026-06-18 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the "dbrecover.php" and "netremap.php" modu… | |
CVE-2026-8039 | Medium | 6.4 | 2026-06-18 | The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attribute in the 'testimonial' shortcode in… |
CVE-2026-2021 | Medium | 6.4 | 2026-06-18 | The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, an… |
CVE-2026-55746 | High | 7.6 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_titl… |
CVE-2026-12137 | Medium | 6.1 | 2026-06-18 | The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scr… |
CVE-2026-12136 | Medium | 6.4 | 2026-06-18 | The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' shortcode in version… |
CVE-2026-12098 | Medium | 6.4 | 2026-06-18 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up… |
CVE-2026-11402 | Medium | 6.4 | 2026-06-18 | The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Att… |
CVE-2026-11358 | Medium | 4.4 | 2026-06-18 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-48768 | Critical | 9.3 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized f… |
CVE-2026-44644 | Medium | 6.1 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in th… |
CVE-2026-54386 | Medium | 6.1 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary Jav… |
CVE-2026-48821 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer… |
CVE-2026-48823 | Medium | 4.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionali… |
CVE-2026-48822 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversi… |
CVE-2026-10850 | Medium | 5.4 | 2026-06-17 | Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the A… |
CVE-2026-40720 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. |
CVE-2025-69140 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions. |
CVE-2025-68524 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions. |
CVE-2026-9570 | High | 7.1 | 2026-06-17 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containin… |
CVE-2026-8607 | Medium | 6.4 | 2026-06-17 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-8494 | Medium | 6.4 | 2026-06-17 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions… |
CVE-2026-8089 | High | 7.1 | 2026-06-17 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a… |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-54192 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. |
CVE-2026-54189 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-54188 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. |
CVE-2026-49778 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. |
CVE-2026-49074 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. |
CVE-2026-48869 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. |
CVE-2026-48788 | High | 8.2 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-… |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-41557 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. |
CVE-2026-40765 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. |
CVE-2026-39597 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. |
CVE-2026-39548 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
CVE-2026-27870 | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable s… | |
CVE-2026-22339 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-22328 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. |
CVE-2026-12463 | Medium | 4.7 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to i… |
CVE-2026-12459 | Medium | 6.1 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-11975 | | 2026-06-17 | Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary… | |
CVE-2025-69151 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions. |
CVE-2025-69104 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions. |
CVE-2025-59560 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions. |
CVE-2025-31013 | High | 7.1 | 2026-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Th… |
CVE-2024-49269 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. |
CVE-2026-48294 | High | 7.4 | 2026-06-17 | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could e… |
CVE-2026-46955 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. D… |
CVE-2026-46856 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-46853 | Critical | 9.6 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are af… |
CVE-2026-12425 | Medium | 6.1 | 2026-06-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Si… |
CVE-2024-30476 | Medium | 5.4 | 2026-06-16 | PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentia… |
CVE-2026-54198 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions. |
CVE-2026-54191 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. |
CVE-2026-39437 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions. |
CVE-2026-10093 | Medium | 6.4 | 2026-06-16 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all… |
CVE-2026-48157 | Medium | 6.1 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpExceptio… |
CVE-2026-52702 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. |
CVE-2026-49773 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions. |
CVE-2026-49055 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions. |
CVE-2026-48966 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions. |
CVE-2026-48885 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. |
CVE-2026-48880 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions. |