CWE-79 · Cross-site Scripting (page 34)
Page 34 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54191 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. |
CVE-2026-39437 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions. |
CVE-2026-10093 | Medium | 6.4 | 2026-06-16 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all… |
CVE-2026-48157 | Medium | 6.1 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpExceptio… |
CVE-2026-52702 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. |
CVE-2026-49773 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions. |
CVE-2026-49055 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions. |
CVE-2026-48966 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions. |
CVE-2026-48885 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. |
CVE-2026-48880 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions. |
CVE-2026-48876 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions. |
CVE-2026-48871 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions. |
CVE-2026-48870 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions. |
CVE-2026-48867 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions. |
CVE-2026-48838 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. |
CVE-2026-45437 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions. |
CVE-2026-42775 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions. |
CVE-2026-42688 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions. |
CVE-2026-42686 | High | 7.1 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions. |
CVE-2026-42663 | Medium | 6.5 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions. |
CVE-2026-42658 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions. |
CVE-2026-42656 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions. |
CVE-2026-42650 | High | 7.2 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions. |
CVE-2026-42649 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions. |
CVE-2026-41556 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions. |
CVE-2026-40791 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions. |
CVE-2026-40787 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions. |
CVE-2026-40770 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. |
CVE-2026-40732 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. |
CVE-2026-39540 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions. |
CVE-2026-39514 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. |
CVE-2026-39507 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. |
CVE-2026-39491 | Medium | 6.5 | 2026-06-15 | Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions. |
CVE-2026-39463 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. |
CVE-2026-39451 | Medium | 6.3 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions. |
CVE-2026-39449 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. |
CVE-2026-39447 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. |
CVE-2026-39435 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions. |
CVE-2026-34902 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions. |
CVE-2026-34900 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. |
CVE-2026-23970 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. |
CVE-2025-68872 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions. |
CVE-2025-68851 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. |
CVE-2025-68840 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. |
CVE-2026-50883 | Critical | 9.6 | 2026-06-15 | An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload. |
CVE-2026-50876 | Medium | 5.4 | 2026-06-15 | A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2026-37216 | Medium | 6.1 | 2026-06-15 | Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add. |
CVE-2026-36521 | Medium | 6.1 | 2026-06-15 | PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module. |
CVE-2026-49294 | Medium | 6.1 | 2026-06-15 | Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cros… |
CVE-2025-15659 | Medium | 6.5 | 2026-06-15 | Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions. |
CVE-2025-15658 | Medium | 5.9 | 2026-06-15 | Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions. |
CVE-2016-20084 | High | 7.2 | 2026-06-15 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar se… |
CVE-2016-20070 | Medium | 6.4 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to… |
CVE-2016-20066 | High | 7.2 | 2026-06-15 | WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file up… |
CVE-2026-12202 | Low | 2.4 | 2026-06-15 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. S… |
CVE-2026-12176 | Medium | 4.3 | 2026-06-14 | A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impacted element is an unknown function of… |
CVE-2026-5513 | High | 7.2 | 2026-06-13 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-n… |
CVE-2026-9629 | Medium | 6.4 | 2026-06-13 | The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insuffi… |
CVE-2026-3297 | Medium | 6.4 | 2026-06-13 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions… |
CVE-2026-9134 | Medium | 6.4 | 2026-06-13 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and incl… |
CVE-2026-9109 | High | 7.2 | 2026-06-13 | The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-9061 | Low | 3.5 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordP… |
CVE-2026-11443 | Medium | 4.6 | 2026-06-13 | Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to execute arbitrary script on… |
CVE-2026-53608 | High | 8.7 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google An… |
CVE-2026-54395 | | 2026-06-12 | MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler… | |
CVE-2026-54393 | | 2026-06-12 | A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path… | |
CVE-2026-53606 | Medium | 5.4 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-ht… |
CVE-2026-45014 | | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsani… | |
CVE-2026-45011 | High | 7.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functiona… |
CVE-2026-44990 | Critical | 9.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default confi… |
CVE-2026-12130 | Low | 3.5 | 2026-06-12 | A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the c… |
CVE-2026-12129 | Low | 3.5 | 2026-06-12 | A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/a… |
CVE-2026-53724 | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default… | |
CVE-2026-53568 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This i… | |
CVE-2026-53722 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to… |
CVE-2026-47739 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This iss… | |
CVE-2026-44205 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to… | |
CVE-2026-46342 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server v… |
CVE-2026-9125 | Medium | 6.4 | 2026-06-12 | The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in ve… |
CVE-2026-42653 | High | 7.1 | 2026-06-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects… |
CVE-2026-46489 | High | 8.1 | 2026-06-11 | SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authen… |
CVE-2026-8589 | High | 7.3 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-10087 | High | 8.7 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain co… |
CVE-2023-33999 | High | 7.1 | 2026-06-11 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue aff… |
CVE-2026-40986 | Medium | 4.8 | 2026-06-11 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scr… |
CVE-2026-2827 | Medium | 4.7 | 2026-06-11 | The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and in… |
CVE-2026-42558 | High | 7.6 | 2026-06-10 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain… |
CVE-2026-53742 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contr… |
CVE-2026-53741 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field… |
CVE-2026-53740 | Medium | 5.4 | 2026-06-10 | Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a rep… |
CVE-2026-53737 | Medium | 6.1 | 2026-06-10 | Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected fe… |
CVE-2026-0266 | Medium | 4.8 | 2026-06-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload… |
CVE-2026-45106 | Medium | 4.6 | 2026-06-10 | Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any… |
CVE-2026-46642 | Medium | 6.1 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the e… |
CVE-2026-20258 | High | 7.1 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-46609 | Medium | 4.6 | 2026-06-10 | Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in… |
CVE-2026-53693 | | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection… | |
CVE-2026-53473 | High | 7.3 | 2026-06-10 | A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript… |
CVE-2026-45560 | Medium | 6.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wrap_line (app/modules/common/common.py:1… |
CVE-2026-53441 | Medium | 5.4 | 2026-06-10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline c… |