CWE-79 · Cross-site Scripting (page 43)
Page 43 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25386 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dmzholes.cgi script that allow attacker… |
CVE-2019-25385 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by ma… |
CVE-2019-25384 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the portfw.cgi script that allow attackers… |
CVE-2019-25383 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the apcupsd.cgi script that allow attackers… |
CVE-2019-25382 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicio… |
CVE-2019-25381 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers t… |
CVE-2019-25380 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dhcp.cgi script that allow attackers to… |
CVE-2019-25379 | High | 7.2 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains stored and reflected cross-site scripting vulnerabilities in the urlfilter.cgi endpoint that allow att… |
CVE-2019-25378 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple cross-site scripting vulnerabilities in the proxy.cgi endpoint that allow attackers to inject… |
CVE-2026-2101 | High | 8.7 | 2026-02-16 | A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19… |
CVE-2026-26930 | High | 7.2 | 2026-02-16 | SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. |
CVE-2025-65717 | Medium | 4.3 | 2026-02-16 | An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page. |
CVE-2026-2557 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the c… |
CVE-2025-59905 | Medium | 6.1 | 2026-02-16 | Cross-Site Scripting (XSS) vulnerability reflected in Kubysoft, which occurs through multiple parameters within the endpoint ‘/node/kudaby/nodeFN/procedure’. T… |
CVE-2025-59904 | Medium | 5.4 | 2026-02-16 | Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, which is triggered through multiple parameters in the '/kForms/app' endpoint. This issue allows ma… |
CVE-2025-59903 | Medium | 5.4 | 2026-02-16 | Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, where uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scr… |
CVE-2026-2547 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipula… |
CVE-2026-2546 | Low | 3.5 | 2026-02-16 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-2545 | Low | 3.5 | 2026-02-16 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulat… |
CVE-2019-25377 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scri… |
CVE-2019-25376 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted p… |
CVE-2019-25375 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted i… |
CVE-2019-25374 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks… |
CVE-2019-25373 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input… |
CVE-2019-25372 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25371 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25370 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through mul… |
CVE-2019-25369 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malici… |
CVE-2019-25368 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through m… |
CVE-2019-25367 | Medium | 5.4 | 2026-02-15 | ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user… |
CVE-2026-1512 | Medium | 6.4 | 2026-02-14 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's I… |
CVE-2026-1843 | High | 7.2 | 2026-02-14 | The Super Page Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Activity Log in all versions up to, and including, 5.2.2 due to… |
CVE-2026-0550 | Medium | 6.4 | 2026-02-14 | The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mycred_load_coupon' shortcode in all versions up to, and includi… |
CVE-2026-1985 | Medium | 6.4 | 2026-02-14 | The Press3D plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 3D Model Gutenberg block in all versions up to, and including, 1.0.2. Thi… |
CVE-2026-1939 | Medium | 6.4 | 2026-02-14 | The Percent to Infograph plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `percent_to_graph` shortcode in all versions up to, and incl… |
CVE-2026-1915 | Medium | 6.4 | 2026-02-14 | The Simple Plyr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poster' parameter in the 'plyr' shortcode in all versions up to, and… |
CVE-2026-1910 | Medium | 6.4 | 2026-02-14 | The UpMenu – Online ordering for restaurants plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lang' attribute of the 'upmenu-menu' sh… |
CVE-2026-1905 | Medium | 6.4 | 2026-02-14 | The Sphere Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in the 'show_sphere_image' shortcode in all vers… |
CVE-2026-1903 | Medium | 6.4 | 2026-02-14 | The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute of the 'sb_ravelry_designs' shortcode i… |
CVE-2026-1901 | Medium | 6.4 | 2026-02-14 | The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcode in all versions up to, and including… |
CVE-2026-1796 | Medium | 6.1 | 2026-02-14 | The StyleBidet plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 1.0.0 due to insuffi… |
CVE-2026-1795 | Medium | 6.1 | 2026-02-14 | The Address Bar Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL Path in all versions up to, and including, 1.0.0 due to in… |
CVE-2026-1792 | Medium | 6.1 | 2026-02-14 | The Geo Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL path in all versions up to, and including, 1.0 due to insufficient… |
CVE-2026-1187 | Medium | 6.4 | 2026-02-14 | The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up… |
CVE-2026-1096 | Medium | 6.4 | 2026-02-14 | The Best-wp-google-map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'latitude' and 'longitudinal' parameters of the 'google_map_vi… |
CVE-2026-0753 | High | 7.2 | 2026-02-14 | The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscf_name' parameter in all versions up to, and inc… |
CVE-2026-0751 | Medium | 6.4 | 2026-02-14 | The Payment Page | Payment Form for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricing_plan_select_text_font_family' par… |
CVE-2026-0736 | Medium | 6.4 | 2026-02-14 | The Chatbot for WordPress by Collect.chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_inpost_head_script[synth_header_script]'… |
CVE-2026-0735 | Medium | 4.4 | 2026-02-14 | The User Language Switch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_color_picker_language_switch' parameter in all versions… |
CVE-2026-0693 | Medium | 4.4 | 2026-02-14 | The Allow HTML in Category Descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via category descriptions in all versions up to, and… |
CVE-2026-0559 | Medium | 6.4 | 2026-02-14 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm… |
CVE-2026-0557 | Medium | 6.4 | 2026-02-14 | The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app' shortcode in all versions up to, and including… |
CVE-2025-15483 | Medium | 4.4 | 2026-02-14 | The Link Hopper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hop_name’ parameter in all versions up to, and including, 2.5 due to… |
CVE-2026-2027 | Medium | 4.4 | 2026-02-14 | The AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AMP Custom CSS setting in all… |
CVE-2026-1912 | Medium | 6.4 | 2026-02-14 | The Citations tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in the 'ctdoi' shortcode in all versions up to… |
CVE-2026-1904 | Medium | 6.4 | 2026-02-14 | The Simple Wp colorfull Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'accordion' shortcode in a… |
CVE-2026-1754 | Medium | 6.1 | 2026-02-14 | The personal-authors-category plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.3 d… |
CVE-2026-1164 | Medium | 6.1 | 2026-02-14 | The Easy Voice Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2.5 d… |
CVE-2026-1844 | High | 7.2 | 2026-02-13 | The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' paramet… |
CVE-2026-1841 | High | 7.2 | 2026-02-13 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter… |
CVE-2026-26226 | | 2026-02-13 | beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controll… | |
CVE-2025-70095 | Medium | 6.5 | 2026-02-13 | A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web… |
CVE-2025-70094 | Medium | 6.5 | 2026-02-13 | A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or H… |
CVE-2025-70091 | Medium | 6.5 | 2026-02-13 | A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2026-1578 | | 2026-02-13 | HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasin… | |
CVE-2026-1721 | | 2026-02-13 | Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query param… | |
CVE-2026-26188 | Medium | 5.4 | 2026-02-12 | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject… |
CVE-2025-70092 | Medium | 5.5 | 2026-02-12 | A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2019-25324 | Medium | 6.1 | 2026-02-12 | RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML co… |
CVE-2019-25323 | Medium | 6.1 | 2026-02-12 | Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the… |
CVE-2025-70845 | Medium | 6.1 | 2026-02-12 | lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly sanitized or escaped. |
CVE-2026-1320 | High | 7.2 | 2026-02-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header… |
CVE-2025-13002 | High | 8.2 | 2026-02-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commer… |
CVE-2026-1316 | High | 7.2 | 2026-02-12 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in all versions up to… |
CVE-2026-2276 | | 2026-02-12 | Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.com/account/account-settings ', responsi… | |
CVE-2025-41117 | Medium | 6.8 | 2026-02-12 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious Ja… |
CVE-2026-26023 | Medium | 6.1 | 2026-02-11 | Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend… |
CVE-2026-25935 | Medium | 5.4 | 2026-02-11 | Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since t… |
CVE-2026-25759 | High | 8.7 | 2026-02-11 | Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authent… |
CVE-2020-37153 | Critical | 9.8 | 2026-02-11 | ASTPP 4.0.1 contains multiple vulnerabilities including cross-site scripting and command injection in SIP device configuration and plugin management interfaces… |
CVE-2025-70297 | Medium | 6.1 | 2026-02-11 | A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to i… |
CVE-2026-25868 | Medium | 6.1 | 2026-02-11 | MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application construct… |
CVE-2026-2344 | | 2026-02-11 | A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessMa… | |
CVE-2019-25317 | Medium | 6.4 | 2026-02-11 | Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can i… |
CVE-2019-25316 | Medium | 6.4 | 2026-02-11 | GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title… |
CVE-2019-25315 | Medium | 6.4 | 2026-02-11 | WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered l… |
CVE-2019-25312 | Medium | 5.4 | 2026-02-11 | InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts… |
CVE-2019-25311 | Medium | 6.4 | 2026-02-11 | thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data i… |
CVE-2018-25157 | Medium | 6.4 | 2026-02-11 | Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names du… |
CVE-2026-2337 | | 2026-02-11 | A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet Bus… | |
CVE-2025-8668 | Critical | 9.4 | 2026-02-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and… |
CVE-2026-0595 | High | 7.3 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2025-14560 | High | 7.3 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2026-1885 | Medium | 6.4 | 2026-02-11 | The Slideshow Wp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sswpid' attribute of the 'sswp-slide' shortcode in all versions up… |
CVE-2026-1853 | Medium | 6.4 | 2026-02-11 | The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and… |
CVE-2026-1827 | Medium | 6.4 | 2026-02-11 | The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and i… |
CVE-2026-1826 | Medium | 6.4 | 2026-02-11 | The OpenPOS Lite – Point of Sale for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter of the order_qrcod… |
CVE-2026-1821 | Medium | 6.4 | 2026-02-11 | The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_reservation shortcode in all versions up… |
CVE-2026-1809 | Medium | 6.4 | 2026-02-11 | The HTML Tag Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1… |
CVE-2026-1804 | Medium | 6.4 | 2026-02-11 | The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to… |