CWE-79 · Cross-site Scripting (page 36)
Page 36 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47637 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-47636 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-47634 | High | 7.3 | 2026-06-09 | Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker… |
CVE-2026-47631 | High | 8.1 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform sp… |
CVE-2026-45644 | High | 8.0 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevat… |
CVE-2026-45501 | Medium | 6.5 | 2026-06-09 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
CVE-2026-45500 | Medium | 6.1 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform sp… |
CVE-2026-45483 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perfor… |
CVE-2026-45481 | High | 7.3 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-45479 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-45468 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-45467 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-45465 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-45464 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-45462 | Medium | 4.6 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-45453 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-42599 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler prope… |
CVE-2026-42573 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, p… |
CVE-2026-41098 | High | 8.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over… |
CVE-2026-34692 | Medium | 5.4 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could… |
CVE-2026-33113 | Medium | 5.4 | 2026-06-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-47901 | | 2026-06-09 | Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into the… | |
CVE-2026-47900 | | 2026-06-09 | Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file… | |
CVE-2026-47348 | | 2026-06-09 | Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization… | |
CVE-2026-41031 | High | 8.7 | 2026-06-09 | A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low… |
CVE-2026-8677 | Medium | 6.4 | 2026-06-09 | The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML T… |
CVE-2026-8599 | Medium | 6.4 | 2026-06-09 | The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Camp… |
CVE-2026-34033 | Medium | 5.4 | 2026-06-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0… |
CVE-2026-8981 | Low | 3.5 | 2026-06-09 | The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block tem… |
CVE-2026-41539 | Medium | 6.1 | 2026-06-09 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulner… |
CVE-2026-8977 | Medium | 6.4 | 2026-06-09 | The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_actions' AJAX action in versions up to, a… |
CVE-2026-8895 | Medium | 6.4 | 2026-06-09 | The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including… |
CVE-2026-8883 | Medium | 6.4 | 2026-06-09 | The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and inc… |
CVE-2026-8882 | Medium | 6.4 | 2026-06-09 | The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and includ… |
CVE-2026-8880 | Medium | 6.4 | 2026-06-09 | The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_b… |
CVE-2026-8841 | Medium | 6.4 | 2026-06-09 | The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat' shortcode's 'title' attribute in versi… |
CVE-2026-7662 | Medium | 6.4 | 2026-06-09 | The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attribute of the `epaperflip_embed` shortcod… |
CVE-2026-41846 | Medium | 5.9 | 2026-06-09 | Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScri… |
CVE-2026-41845 | High | 7.1 | 2026-06-09 | Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross… |
CVE-2026-11603 | Medium | 6.1 | 2026-06-09 | The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter in all versi… |
CVE-2026-10738 | Medium | 6.4 | 2026-06-09 | The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, a… |
CVE-2026-10024 | Medium | 6.4 | 2026-06-09 | The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and inclu… |
CVE-2026-7556 | High | 7.2 | 2026-06-09 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5… |
CVE-2026-5714 | Medium | 6.4 | 2026-06-09 | The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘location_dir’ parameter in all versions up to, and includin… |
CVE-2026-10862 | Medium | 6.4 | 2026-06-09 | The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due… |
CVE-2026-44757 | Medium | 4.7 | 2026-06-09 | SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim… |
CVE-2026-44746 | Medium | 6.1 | 2026-06-09 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could craft a URL that embed… |
CVE-2026-44541 | | 2026-06-08 | Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the… | |
CVE-2026-47345 | | 2026-06-08 | Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-san… | |
CVE-2026-47344 | | 2026-06-08 | When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as val… | |
CVE-2026-11534 | Low | 3.5 | 2026-06-08 | A vulnerability was detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown funct… |
CVE-2026-29170 | Medium | 6.1 | 2026-06-08 | A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directo… |
CVE-2026-25558 | Medium | 4.8 | 2026-06-08 | QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicio… |
CVE-2026-11520 | Low | 3.5 | 2026-06-08 | A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipu… |
CVE-2026-11518 | Medium | 4.3 | 2026-06-08 | A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the component User Management… |
CVE-2026-9549 | Medium | 4.8 | 2026-06-08 | Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administra… |
CVE-2026-8833 | Medium | 5.4 | 2026-06-08 | Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an a… |
CVE-2026-8078 | Medium | 4.8 | 2026-06-08 | Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can… |
CVE-2026-7186 | Medium | 5.4 | 2026-06-08 | Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing… |
CVE-2026-11512 | Medium | 4.3 | 2026-06-08 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /billing.php… |
CVE-2026-3011 | Medium | 6.4 | 2026-06-08 | The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all ve… |
CVE-2026-11569 | Medium | 5.4 | 2026-06-08 | A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload… |
CVE-2026-41724 | High | 8.0 | 2026-06-08 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or… |
CVE-2026-41723 | High | 8.0 | 2026-06-08 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or… |
CVE-2026-41722 | High | 8.0 | 2026-06-08 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or… |
CVE-2026-11491 | Low | 2.4 | 2026-06-08 | A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the compone… |
CVE-2023-54351 | High | 7.2 | 2026-06-08 | WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts throug… |
CVE-2021-47984 | Medium | 6.4 | 2026-06-08 | WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts b… |
CVE-2021-47983 | Medium | 6.4 | 2026-06-08 | WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scr… |
CVE-2021-47982 | Medium | 6.4 | 2026-06-08 | WordPress Plugin WP-Paginate 2.1.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by mani… |
CVE-2026-11468 | Low | 2.4 | 2026-06-08 | A vulnerability was detected in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /admin/?… |
CVE-2026-11436 | Medium | 4.3 | 2026-06-06 | A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mage_ai/frontend/components/Sessions/SignForm/index.tsx… |
CVE-2026-11434 | Low | 2.4 | 2026-06-06 | A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This m… |
CVE-2026-9594 | Medium | 4.4 | 2026-06-06 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-9280 | Medium | 6.1 | 2026-06-06 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versio… |
CVE-2026-8991 | Medium | 4.4 | 2026-06-06 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_… |
CVE-2026-7796 | Medium | 6.4 | 2026-06-06 | The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2026-7795 | Medium | 6.4 | 2026-06-06 | The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in all versions up to… |
CVE-2026-9281 | Medium | 6.4 | 2026-06-06 | The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-8901 | High | 7.2 | 2026-06-06 | The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2026-8438 | High | 7.2 | 2026-06-06 | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7… |
CVE-2026-8900 | Medium | 6.4 | 2026-06-06 | The Simple SEO Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.2.8… |
CVE-2026-8893 | Medium | 6.4 | 2026-06-06 | The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in… |
CVE-2026-45778 | Medium | 5.4 | 2026-06-05 | OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authenticated attacker can inject malicious JavaScript int… |
CVE-2026-25624 | Medium | 5.7 | 2026-06-05 | An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Gen… |
CVE-2026-46511 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token expo… | |
CVE-2026-46496 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due t… | |
CVE-2026-46396 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due t… | |
CVE-2026-11338 | Low | 2.4 | 2026-06-05 | A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page… |
CVE-2026-11337 | Medium | 4.3 | 2026-06-05 | A vulnerability was found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected… |
CVE-2026-38579 | Medium | 6.1 | 2026-06-05 | Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to inject arbitrary web… |
CVE-2026-50235 | Medium | 6.1 | 2026-06-05 | Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input befor… |
CVE-2026-50232 | High | 7.2 | 2026-06-05 | Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata ta… |
CVE-2026-50231 | High | 7.2 | 2026-06-05 | Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scr… |
CVE-2026-50230 | Medium | 6.1 | 2026-06-05 | Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject a… |
CVE-2026-21825 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary J… |
CVE-2026-50592 | Medium | 6.4 | 2026-06-05 | In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view). |
CVE-2026-50591 | Medium | 5.4 | 2026-06-05 | In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences. |
CVE-2026-11273 | Medium | 6.1 | 2026-06-05 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-11186 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |