CWE-79 · Cross-site Scripting (page 34)
Page 34 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2072 | High | 8.2 | 2026-03-25 | Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hita… |
CVE-2026-4766 | Medium | 6.4 | 2026-03-25 | The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and i… |
CVE-2026-28871 | Medium | 4.3 | 2026-03-25 | A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4… |
CVE-2026-28861 | Medium | 4.3 | 2026-03-25 | A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS T… |
CVE-2026-33347 | Medium | 6.1 | 2026-03-24 | league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a… |
CVE-2026-33331 | High | 8.2 | 2026-03-24 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XS… |
CVE-2026-33400 | Medium | 5.4 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment… |
CVE-2026-33334 | Critical | 9.6 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper ena… |
CVE-2026-29840 | Medium | 5.4 | 2026-03-24 | JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The applica… |
CVE-2026-30661 | Medium | 6.1 | 2026-03-24 | iCMS v8.0.0 contains a Cross-Site Scripting (XSS) vulnerability in the User Management component, specifically within the index.html file. This allows remote a… |
CVE-2026-33311 | Medium | 4.7 | 2026-03-24 | DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and 9.4.1, SVG attribut… |
CVE-2026-4754 | Medium | 6.1 | 2026-03-24 | CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11. |
CVE-2026-4626 | Low | 3.5 | 2026-03-24 | A vulnerability has been found in projectworlds Lawyer Management System 1.0. This impacts an unknown function of the file /lawyer_booking.php. The manipulatio… |
CVE-2026-4616 | Low | 2.4 | 2026-03-24 | A security flaw has been discovered in bolo-blog up to 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Articl… |
CVE-2026-33170 | Medium | 6.1 | 2026-03-24 | Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1… |
CVE-2026-33168 | | 2026-03-23 | Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank str… | |
CVE-2026-33167 | Medium | 6.1 | 2026-03-23 | Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does n… |
CVE-2026-32278 | High | 8.2 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |
CVE-2026-32277 | High | 8.7 | 2026-03-23 | Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in… |
CVE-2025-60948 | Medium | 4.6 | 2026-03-23 | Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes… |
CVE-2026-4596 | Low | 3.5 | 2026-03-23 | A vulnerability was identified in projectworlds Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyers.php. The manipula… |
CVE-2026-33548 | Medium | 6.1 | 2026-03-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_pa… |
CVE-2026-33517 | Medium | 6.1 | 2026-03-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when disp… |
CVE-2026-32852 | Medium | 6.1 | 2026-03-23 | MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbi… |
CVE-2026-32851 | Medium | 6.1 | 2026-03-23 | MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbi… |
CVE-2026-32850 | Medium | 6.1 | 2026-03-23 | MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbi… |
CVE-2025-52204 | Medium | 6.1 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter |
CVE-2024-46879 | Medium | 5.4 | 2026-03-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2. This vulnerability… |
CVE-2024-46878 | Medium | 5.4 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attack… |
CVE-2026-4595 | Low | 2.4 | 2026-03-23 | A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a… |
CVE-2026-33683 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field a… |
CVE-2026-33500 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcqw-6466-3mv7) introduced a custom `Parse… |
CVE-2026-33499 | Medium | 6.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect t… |
CVE-2024-51226 | Medium | 6.1 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51225 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to… |
CVE-2024-51224 | Medium | 4.8 | 2026-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51223 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2024-51222 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2026-4578 | Low | 2.4 | 2026-03-23 | A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executi… |
CVE-2026-4577 | Low | 2.4 | 2026-03-23 | A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a… |
CVE-2025-6229 | Medium | 6.4 | 2026-03-23 | The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Te… |
CVE-2026-4576 | Low | 2.4 | 2026-03-23 | A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. Such manipulation o… |
CVE-2026-4575 | Low | 2.4 | 2026-03-23 | A flaw has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s2.php. This manipulation… |
CVE-2026-4557 | Medium | 4.3 | 2026-03-22 | A vulnerability was detected in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s1.php. Performing a manipul… |
CVE-2026-33295 | Medium | 5.4 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's downl… |
CVE-2026-4544 | Low | 2.4 | 2026-03-22 | A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Hand… |
CVE-2026-3427 | Medium | 6.4 | 2026-03-22 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` b… |
CVE-2025-71276 | Medium | 6.4 | 2026-03-22 | SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. |
CVE-2026-4510 | Medium | 4.3 | 2026-03-21 | A weakness has been identified in PbootCMS up to 3.2.12. This impacts the function alert_location of the file apps/home/controller/MemberController.php of the… |
CVE-2026-4161 | Medium | 4.4 | 2026-03-21 | The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including… |
CVE-2026-4086 | Medium | 6.4 | 2026-03-21 | The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_rando… |
CVE-2026-4084 | Medium | 6.4 | 2026-03-21 | The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in… |
CVE-2026-4077 | Medium | 6.4 | 2026-03-21 | The Ecover Builder For Dummies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'ecover' shortcode in all versio… |
CVE-2026-4072 | Medium | 6.4 | 2026-03-21 | The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including… |
CVE-2026-4069 | Medium | 6.1 | 2026-03-21 | The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1… |
CVE-2026-4067 | Medium | 6.4 | 2026-03-21 | The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including… |
CVE-2026-4022 | Medium | 6.4 | 2026-03-21 | The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute… |
CVE-2026-3997 | Medium | 6.4 | 2026-03-21 | The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in a… |
CVE-2026-3996 | Medium | 6.4 | 2026-03-21 | The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta. This… |
CVE-2026-3619 | Medium | 6.4 | 2026-03-21 | The Sheets2Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titles' shortcode attribute in the [sheets2table-render-table] shor… |
CVE-2026-3617 | Medium | 6.4 | 2026-03-21 | The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to… |
CVE-2026-3554 | Medium | 6.4 | 2026-03-21 | The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to… |
CVE-2026-3354 | Medium | 4.4 | 2026-03-21 | The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5. Thi… |
CVE-2026-3353 | Medium | 4.4 | 2026-03-21 | The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1… |
CVE-2026-3347 | Medium | 5.5 | 2026-03-21 | The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `arv_lb[message]` parameter in all versions up to… |
CVE-2026-3333 | Medium | 6.4 | 2026-03-21 | The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and in… |
CVE-2026-3003 | High | 7.2 | 2026-03-21 | The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and includin… |
CVE-2026-2837 | Medium | 4.4 | 2026-03-21 | The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1… |
CVE-2026-2501 | Medium | 6.4 | 2026-03-21 | The Ed's Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `social_share` shortcode in all versions up to, and in… |
CVE-2026-2496 | Medium | 6.4 | 2026-03-21 | The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `eds_font_awesome` shortcode in all versions up to, an… |
CVE-2026-2440 | High | 7.2 | 2026-03-21 | The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions. This… |
CVE-2026-2427 | Medium | 6.1 | 2026-03-21 | The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and includ… |
CVE-2026-2424 | Medium | 4.4 | 2026-03-21 | The Reward Video Ad for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1… |
CVE-2026-2277 | Medium | 6.1 | 2026-03-21 | The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in a… |
CVE-2026-2121 | Medium | 4.4 | 2026-03-21 | The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8… |
CVE-2026-1914 | Medium | 6.4 | 2026-03-21 | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including… |
CVE-2026-1911 | Medium | 6.4 | 2026-03-21 | The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all vers… |
CVE-2026-1908 | Medium | 6.4 | 2026-03-21 | The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and… |
CVE-2026-1899 | Medium | 6.4 | 2026-03-21 | The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and includin… |
CVE-2026-1891 | Medium | 6.4 | 2026-03-21 | The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to… |
CVE-2026-1889 | Medium | 6.4 | 2026-03-21 | The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and incl… |
CVE-2026-1886 | Medium | 6.4 | 2026-03-21 | The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in… |
CVE-2026-1854 | Medium | 6.4 | 2026-03-21 | The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1… |
CVE-2026-1851 | Medium | 6.4 | 2026-03-21 | The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and includ… |
CVE-2026-1822 | Medium | 6.4 | 2026-03-21 | The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and includin… |
CVE-2026-1806 | Medium | 6.4 | 2026-03-21 | The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc… |
CVE-2026-1647 | Medium | 6.1 | 2026-03-21 | The Comment Genius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and inc… |
CVE-2026-1575 | Medium | 6.4 | 2026-03-21 | The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `itemscope` shortcode in all versions up to, and includ… |
CVE-2026-1397 | Medium | 6.4 | 2026-03-21 | The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and i… |
CVE-2026-1278 | Medium | 4.4 | 2026-03-21 | The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to ins… |
CVE-2026-1275 | Medium | 6.4 | 2026-03-21 | The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up t… |
CVE-2026-1247 | Medium | 4.4 | 2026-03-21 | The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient i… |
CVE-2026-1093 | Medium | 6.4 | 2026-03-21 | The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqb… |
CVE-2026-0609 | Medium | 6.4 | 2026-03-21 | The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt… |
CVE-2025-13910 | Medium | 6.1 | 2026-03-21 | The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and i… |
CVE-2026-4083 | Medium | 6.4 | 2026-03-21 | The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and… |
CVE-2026-3577 | Medium | 4.4 | 2026-03-21 | The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_al… |
CVE-2026-3572 | Medium | 6.1 | 2026-03-21 | The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2… |
CVE-2026-3516 | Medium | 6.4 | 2026-03-21 | The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0… |
CVE-2026-3368 | High | 7.2 | 2026-03-21 | The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1… |