CWE-79 · Cross-site Scripting (page 42)
Page 42 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27057 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everythi… |
CVE-2026-25472 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored X… |
CVE-2026-25463 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored… |
CVE-2026-25453 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based… |
CVE-2026-25451 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2026-25432 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This… |
CVE-2026-25362 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This i… |
CVE-2026-25343 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue… |
CVE-2026-25331 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DO… |
CVE-2026-25307 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.Th… |
CVE-2026-25305 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affe… |
CVE-2026-25004 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-… |
CVE-2026-24392 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.Thi… |
CVE-2025-40697 | | 2026-02-19 | Reflected Cross-Site Scripting (XSS) vulnerability in '/index.php' in Lewe WebMeasure, which allows remote attackers to execute arbitrary code through the 'pag… | |
CVE-2026-2502 | Medium | 6.1 | 2026-02-19 | The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' H… |
CVE-2026-2282 | Medium | 4.4 | 2026-02-19 | The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insuffici… |
CVE-2026-1646 | Medium | 6.4 | 2026-02-19 | The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg blo… |
CVE-2026-1373 | Medium | 6.4 | 2026-02-19 | The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, a… |
CVE-2026-1055 | Medium | 4.4 | 2026-02-19 | The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficien… |
CVE-2026-1047 | Medium | 4.4 | 2026-02-19 | The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including… |
CVE-2026-1044 | Medium | 4.4 | 2026-02-19 | The Tennis Court Bookings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due… |
CVE-2026-1043 | Medium | 4.4 | 2026-02-19 | The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2… |
CVE-2026-0561 | Medium | 6.1 | 2026-02-19 | The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0… |
CVE-2026-0556 | Medium | 6.4 | 2026-02-19 | The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and… |
CVE-2026-0549 | Medium | 6.4 | 2026-02-19 | The Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'groups_group_info' shortcode in all versions up to, and includin… |
CVE-2025-14983 | Medium | 6.4 | 2026-02-19 | The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 5.0.1 due to in… |
CVE-2025-14851 | Medium | 6.4 | 2026-02-19 | The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode parameters in all versions up to, and incl… |
CVE-2025-14452 | High | 7.2 | 2026-02-19 | The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and includi… |
CVE-2025-14445 | Medium | 6.4 | 2026-02-19 | The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' custom field meta in all versions up to… |
CVE-2025-14076 | Medium | 6.1 | 2026-02-19 | The iXML – Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up… |
CVE-2025-13738 | Medium | 6.4 | 2026-02-19 | The Easy Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ez-toc` shortcode in all versions up to, and inc… |
CVE-2025-13732 | Medium | 6.4 | 2026-02-19 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored… |
CVE-2025-13617 | Medium | 6.4 | 2026-02-19 | The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a13_alt_link’ parameter in all versions up to, and… |
CVE-2025-13612 | Medium | 6.4 | 2026-02-19 | The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in… |
CVE-2025-13048 | Medium | 6.4 | 2026-02-19 | The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to… |
CVE-2025-12451 | Medium | 4.4 | 2026-02-19 | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 4.0 due to in… |
CVE-2025-12448 | Medium | 6.4 | 2026-02-19 | The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all… |
CVE-2025-12117 | Medium | 6.4 | 2026-02-19 | The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.1 due to insufficient… |
CVE-2025-12116 | Medium | 6.4 | 2026-02-19 | The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 due to insufficient i… |
CVE-2025-11706 | Medium | 6.1 | 2026-02-19 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3… |
CVE-2026-26281 | Medium | 4.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Su… |
CVE-2026-26270 | Medium | 5.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25596 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25595 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25594 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-24745 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-27178 | High | 7.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /obj… |
CVE-2026-27177 | High | 7.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unau… |
CVE-2026-27176 | Medium | 6.1 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly int… |
CVE-2026-24744 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-24743 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2019-25400 | Medium | 5.4 | 2026-02-18 | IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious… |
CVE-2019-25399 | Medium | 6.4 | 2026-02-18 | IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious sc… |
CVE-2019-25398 | Medium | 6.1 | 2026-02-18 | IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts… |
CVE-2019-25397 | Medium | 6.1 | 2026-02-18 | IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious s… |
CVE-2019-25396 | Medium | 6.1 | 2026-02-18 | IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious s… |
CVE-2019-25356 | Medium | 6.1 | 2026-02-18 | Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a cross-site scripting vulnerability in the admin configuration page. Attackers can i… |
CVE-2026-24746 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-25500 | Medium | 5.4 | 2026-02-18 | Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file e… |
CVE-2026-27099 | High | 8.0 | 2026-02-18 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporari… |
CVE-2026-1404 | Medium | 6.1 | 2026-02-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflec… |
CVE-2026-1441 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1440 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1439 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1438 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2026-1437 | Medium | 6.1 | 2026-02-18 | Reflected Cross-Site Scripting (XSS) vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in… |
CVE-2025-8308 | Medium | 6.3 | 2026-02-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Infor… |
CVE-2025-14340 | | 2026-02-18 | Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator t… | |
CVE-2025-13727 | Medium | 4.4 | 2026-02-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions u… |
CVE-2025-11185 | Medium | 6.4 | 2026-02-18 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all… |
CVE-2026-1941 | Medium | 6.4 | 2026-02-18 | The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and inc… |
CVE-2026-1649 | Medium | 4.4 | 2026-02-18 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ce_venue_name' parameter in all versions up to, and including… |
CVE-2026-1943 | Medium | 4.4 | 2026-02-18 | The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including… |
CVE-2026-2281 | Medium | 4.4 | 2026-02-18 | The Private Comment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Label text' setting in all versions up to, and including, 0.0.4… |
CVE-2026-1807 | Medium | 6.4 | 2026-02-18 | The InteractiveCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interactivecalculator' shortcode in… |
CVE-2026-1666 | Medium | 6.1 | 2026-02-18 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including… |
CVE-2026-1304 | Medium | 4.4 | 2026-02-18 | The Membership Plugin – Restrict Content for WordPress is vulnerable to Stored Cross-Site Scripting via multiple invoice settings fields in all versions up to… |
CVE-2025-11737 | Medium | 6.4 | 2026-02-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_sns_title' parameter in all versions up to… |
CVE-2026-1931 | High | 7.2 | 2026-02-18 | The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due t… |
CVE-2025-6460 | Medium | 6.4 | 2026-02-18 | The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, a… |
CVE-2025-13959 | Medium | 6.4 | 2026-02-18 | The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2… |
CVE-2025-12037 | Medium | 4.4 | 2026-02-18 | The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ… |
CVE-2025-62183 | | 2026-02-17 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… | |
CVE-2025-33135 | Medium | 6.1 | 2026-02-17 | IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Mana… |
CVE-2026-2622 | Low | 3.5 | 2026-02-17 | A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blo… |
CVE-2026-26357 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabili… |
CVE-2025-70846 | High | 7.1 | 2026-02-17 | lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password. |
CVE-2025-36019 | Medium | 6.1 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbit… |
CVE-2026-23861 | Medium | 5.4 | 2026-02-17 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulner… |
CVE-2025-8303 | Medium | 6.5 | 2026-02-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Serv… |
CVE-2026-1216 | High | 7.2 | 2026-02-17 | The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter in all versions up to, and including, 5.0… |
CVE-2026-2002 | Medium | 4.4 | 2026-02-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name par… |
CVE-2019-25395 | High | 7.2 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attacker… |
CVE-2019-25394 | High | 7.2 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the modem.cgi script that allow attackers to i… |
CVE-2019-25393 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |
CVE-2019-25392 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |
CVE-2019-25390 | Medium | 5.4 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attack… |
CVE-2019-25389 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |
CVE-2019-25388 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |
CVE-2019-25387 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |