CWE-79 · Cross-site Scripting (page 41)
Page 41 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68031 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms all… |
CVE-2025-67991 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Re… |
CVE-2025-67990 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected… |
CVE-2025-67984 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This… |
CVE-2025-67978 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue aff… |
CVE-2025-67971 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS… |
CVE-2025-67438 | Medium | 6.1 | 2026-02-20 | A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's… |
CVE-2025-60183 | Medium | 5.9 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows… |
CVE-2025-53237 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected X… |
CVE-2025-53233 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issu… |
CVE-2025-53231 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevstudio Easy Taxonomy Images easy-taxonomy-images all… |
CVE-2025-53228 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-adver… |
CVE-2024-56208 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This iss… |
CVE-2024-52387 | Medium | 5.9 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons al… |
CVE-2024-51915 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache al… |
CVE-2024-50555 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2024-50452 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor a… |
CVE-2026-2486 | Medium | 6.4 | 2026-02-20 | The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to… |
CVE-2026-26370 | Medium | 6.1 | 2026-02-20 | WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary scrip… |
CVE-2026-2825 | Low | 3.5 | 2026-02-20 | A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Mo… |
CVE-2026-2384 | Medium | 6.4 | 2026-02-20 | The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including… |
CVE-2026-26993 | Medium | 4.6 | 2026-02-20 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files witho… |
CVE-2026-26992 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing atta… |
CVE-2026-26991 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing at… |
CVE-2026-27016 | Medium | 5.4 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit paramet… |
CVE-2026-26989 | Medium | 4.3 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-26987 | Medium | 6.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email fie… |
CVE-2026-27009 | Medium | 5.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar)… |
CVE-2026-26953 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a S… |
CVE-2026-26952 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulne… |
CVE-2025-9208 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored… |
CVE-2025-13672 | Medium | 5.4 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflec… |
CVE-2026-27440 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue aff… |
CVE-2026-27360 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored… |
CVE-2026-27013 | High | 7.6 | 2026-02-19 | Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/Tex… |
CVE-2026-26193 | High | 7.3 | 2026-02-19 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history all… |
CVE-2026-26192 | High | 7.3 | 2026-02-19 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allo… |
CVE-2026-27474 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was n… |
CVE-2026-27473 | Medium | 6.4 | 2026-02-19 | SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the pr… |
CVE-2026-26059 | Medium | 5.4 | 2026-02-19 | ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to s… |
CVE-2026-23619 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page. An authenticated user can… |
CVE-2026-23618 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface. A… |
CVE-2026-23617 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An a… |
CVE-2026-23616 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user… |
CVE-2026-23615 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework Email Exceptions interface. An… |
CVE-2026-23614 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework IP Exceptions interface. An aut… |
CVE-2026-23613 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the URI DNS Blocklist configuration page. An authenticated… |
CVE-2026-23612 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page. An authenticated u… |
CVE-2026-23611 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page. An authenticated user can… |
CVE-2026-23610 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint. An authenticated u… |
CVE-2026-23609 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configuration page. An authentic… |
CVE-2026-23608 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint. An authenticate… |
CVE-2026-23607 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interface. An authentica… |
CVE-2026-23606 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow. An a… |
CVE-2026-23605 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation workflow. An authent… |
CVE-2026-23604 | Medium | 5.4 | 2026-02-19 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workflow. An authentica… |
CVE-2026-26345 | Medium | 5.4 | 2026-02-19 | SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patterns. The echapper_htm… |
CVE-2026-26223 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe c… |
CVE-2026-25739 | Medium | 5.4 | 2026-02-19 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cro… |
CVE-2025-71241 | Medium | 6.1 | 2026-02-19 | SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' AP… |
CVE-2025-71240 | Medium | 5.4 | 2026-02-19 | SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tag… |
CVE-2019-25430 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitt… |
CVE-2019-25429 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25428 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoint that allow attackers to inject malici… |
CVE-2019-25427 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25426 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25425 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25424 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting unsanitized… |
CVE-2019-25423 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the /korugan/proxyconfig endpoint that allow attackers to inject… |
CVE-2019-25422 | High | 7.2 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the vpnfw endpoint. Attackers… |
CVE-2019-25421 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains multiple cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the policyfw endpoin… |
CVE-2019-25420 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25419 | High | 7.2 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input t… |
CVE-2019-25418 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25417 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25416 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25415 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting unsanitized… |
CVE-2019-25414 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipul… |
CVE-2019-25413 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipul… |
CVE-2019-25412 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting unsanitized… |
CVE-2019-25411 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the GATEWA… |
CVE-2019-25410 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through the source and des… |
CVE-2019-25409 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the destin… |
CVE-2019-25408 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25407 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted inpu… |
CVE-2019-25406 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the organi… |
CVE-2019-25405 | High | 7.2 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input t… |
CVE-2019-25404 | Medium | 6.4 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting c… |
CVE-2019-25403 | Medium | 6.4 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting c… |
CVE-2019-25402 | Medium | 6.1 | 2026-02-19 | Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitt… |
CVE-2025-15562 | Medium | 6.1 | 2026-02-19 | The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attac… |
CVE-2026-2718 | Medium | 6.4 | 2026-02-19 | The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and includ… |
CVE-2026-2716 | Medium | 4.4 | 2026-02-19 | The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, an… |
CVE-2026-2736 | Medium | 6.1 | 2026-02-19 | Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the vic… |
CVE-2026-2735 | Medium | 5.4 | 2026-02-19 | Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-… |
CVE-2026-27094 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue af… |
CVE-2026-27074 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issu… |
CVE-2026-27069 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This iss… |
CVE-2026-27059 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XS… |
CVE-2026-27058 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based… |