CWE-79 · Cross-site Scripting (page 4)
Page 4 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95670 | High | 7.2 | 2026-10-02 | The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and incl… |
CVE-2026-93880 | Medium | 6.1 | 2026-10-02 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in a… |
CVE-2026-93756 | High | 7.2 | 2026-10-02 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment M… |
CVE-2026-103426 | High | 7.2 | 2026-10-02 | The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 d… |
CVE-2026-102772 | High | 7.2 | 2026-10-02 | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all ver… |
CVE-2026-100182 | High | 7.2 | 2026-10-02 | The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and… |
CVE-2026-100107 | High | 7.2 | 2026-10-02 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2… |
CVE-2026-93697 | Critical | 9.0 | 2026-10-02 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. |
CVE-2026-93029 | Critical | 9.0 | 2026-10-02 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. |
CVE-2026-1661 | Medium | 4.3 | 2026-10-02 | The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens… |
CVE-2026-102565 | High | 7.2 | 2026-10-02 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and inc… |
CVE-2026-91022 | Medium | 6.8 | 2026-10-02 | The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users… |
CVE-2026-90438 | High | 7.2 | 2026-10-02 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field… |
CVE-2026-85016 | Medium | 6.8 | 2026-10-02 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared… |
CVE-2026-84925 | Medium | 6.1 | 2026-10-02 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all ver… |
CVE-2026-78471 | Medium | 5.4 | 2026-10-02 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to… |
CVE-2026-13718 | Medium | 6.8 | 2026-10-02 | The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop ma… |
CVE-2026-93367 | High | 7.2 | 2026-10-02 | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and incl… |
CVE-2026-71454 | | 2026-10-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site… | |
CVE-2026-71542 | | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is… | |
CVE-2026-70650 | | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated s… | |
CVE-2026-54049 | High | 8.7 | 2026-10-01 | Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stor… |
CVE-2026-55230 | High | 8.7 | 2026-10-01 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails… |
CVE-2026-101890 | Medium | 5.4 | 2026-10-01 | The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by… |
CVE-2026-97273 | High | 7.1 | 2026-10-01 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. |
CVE-2026-97268 | High | 7.1 | 2026-10-01 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. |
CVE-2026-97260 | High | 7.1 | 2026-10-01 | Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. |
CVE-2026-56589 | High | 7.2 | 2026-10-01 | HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scr… |
CVE-2026-102378 | High | 7.1 | 2026-10-01 | Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions. |
CVE-2026-103686 | Low | 3.5 | 2026-10-01 | A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the com… |
CVE-2026-103343 | Medium | 6.5 | 2026-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XS… |
CVE-2026-103339 | Medium | 6.5 | 2026-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affect… |
CVE-2026-103064 | Medium | 6.5 | 2026-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite… |
CVE-2026-103063 | Medium | 6.5 | 2026-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite… |
CVE-2026-102394 | Medium | 6.5 | 2026-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2026-103292 | High | 8.0 | 2026-10-01 | Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An au… |
CVE-2026-103277 | High | 8.1 | 2026-10-01 | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally host… |
CVE-2026-103249 | High | 7.6 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locat… |
CVE-2026-96256 | Medium | 6.4 | 2026-10-01 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google… |
CVE-2026-92144 | High | 7.2 | 2026-10-01 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-… |
CVE-2026-7176 | | 2026-10-01 | CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifyin… | |
CVE-2026-7175 | | 2026-10-01 | CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of Jav… | |
CVE-2026-7174 | | 2026-10-01 | CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/… | |
CVE-2026-7173 | | 2026-10-01 | CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a sp… | |
CVE-2026-64950 | | 2026-10-01 | Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user inter… | |
CVE-2026-64946 | | 2026-10-01 | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltrati… | |
CVE-2026-103493 | High | 8.1 | 2026-10-01 | In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible |
CVE-2026-103489 | Low | 2.0 | 2026-10-01 | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible |
CVE-2026-97661 | High | 7.2 | 2026-10-01 | The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, an… |
CVE-2026-96813 | High | 7.2 | 2026-10-01 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Lo… |
CVE-2026-96573 | High | 7.2 | 2026-10-01 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field… |
CVE-2026-96268 | Medium | 6.4 | 2026-10-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in al… |
CVE-2026-92244 | High | 7.2 | 2026-10-01 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company… |
CVE-2026-90992 | Medium | 6.4 | 2026-10-01 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to… |
CVE-2026-89427 | Medium | 6.1 | 2026-10-01 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to… |
CVE-2026-89424 | Medium | 6.4 | 2026-10-01 | The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6… |
CVE-2026-85235 | High | 7.2 | 2026-10-01 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare… |
CVE-2026-14995 | High | 7.2 | 2026-10-01 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to in… |
CVE-2026-103664 | | 2026-10-01 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL… | |
CVE-2026-103662 | | 2026-10-01 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag). The aff… | |
CVE-2026-101925 | Medium | 6.4 | 2026-10-01 | The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via… |
CVE-2026-100184 | Medium | 4.7 | 2026-10-01 | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cro… |
CVE-2026-100179 | Medium | 6.1 | 2026-10-01 | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cro… |
CVE-2026-89047 | Medium | 6.1 | 2026-10-01 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and i… |
CVE-2026-19902 | Medium | 6.1 | 2026-10-01 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, a… |
CVE-2026-92412 | High | 7.1 | 2026-10-01 | The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing… |
CVE-2026-87973 | Low | 3.1 | 2026-10-01 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics pag… |
CVE-2026-87970 | Medium | 4.7 | 2026-10-01 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response tha… |
CVE-2026-86610 | Medium | 6.4 | 2026-10-01 | The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which coul… |
CVE-2026-85679 | High | 7.2 | 2026-10-01 | The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6… |
CVE-2026-81739 | High | 7.5 | 2026-10-01 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin pag… |
CVE-2026-67075 | Medium | 6.5 | 2026-10-01 | HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted… |
CVE-2026-12241 | Medium | 5.4 | 2026-10-01 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly… |
CVE-2026-96561 | High | 7.2 | 2026-10-01 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin… |
CVE-2026-103590 | Medium | 5.4 | 2026-09-30 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce… |
CVE-2026-103589 | Medium | 5.4 | 2026-09-30 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and com… |
CVE-2026-103588 | Medium | 5.4 | 2026-09-30 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers ca… |
CVE-2026-103587 | Medium | 5.4 | 2026-09-30 | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id… |
CVE-2026-47096 | Medium | 6.1 | 2026-09-30 | AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject ma… |
CVE-2026-102147 | Critical | 9.3 | 2026-09-30 | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary J… |
CVE-2026-102126 | High | 8.1 | 2026-09-30 | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to stor… |
CVE-2026-102100 | High | 8.7 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an… |
CVE-2026-102092 | High | 8.7 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that exe… |
CVE-2026-97290 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions. |
CVE-2026-97265 | Medium | 6.5 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. T… |
CVE-2026-94171 | High | 7.1 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS… |
CVE-2026-102391 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. |
CVE-2026-102376 | High | 7.1 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions. |
CVE-2026-100510 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions. |
CVE-2026-100275 | Medium | 6.9 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
CVE-2026-100263 | Medium | 4.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
CVE-2026-62084 | Medium | 6.5 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This… |
CVE-2026-103389 | | 2026-09-30 | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any s… | |
CVE-2026-103388 | | 2026-09-30 | MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTE… | |
CVE-2026-97301 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. |
CVE-2026-97298 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. |
CVE-2026-97292 | Medium | 6.5 | 2026-09-30 | Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. |
CVE-2026-97289 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions. |
CVE-2026-97288 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
CVE-2026-97286 | Medium | 6.5 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows S… |