CWE-79 · Cross-site Scripting (page 44)
Page 44 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0815 | Medium | 4.4 | 2026-02-11 | The Category Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag-image' parameter in all versions up to, and including, 2.0 du… |
CVE-2026-0724 | Medium | 4.4 | 2026-02-11 | The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and incl… |
CVE-2025-15440 | High | 7.2 | 2026-02-11 | The iONE360 configurator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Form Parameters in all versions up to, and includin… |
CVE-2025-13650 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed)… |
CVE-2025-13649 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performe… |
CVE-2025-13648 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software coul… |
CVE-2025-10913 | High | 8.3 | 2026-02-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. Temiz… |
CVE-2026-1893 | Medium | 6.4 | 2026-02-11 | The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name… |
CVE-2026-1231 | Medium | 6.4 | 2026-02-11 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `js` Global Settings… |
CVE-2026-1571 | Medium | 6.1 | 2026-02-11 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted… |
CVE-2026-25956 | Medium | 6.1 | 2026-02-10 | Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could l… |
CVE-2026-24045 | High | 7.3 | 2026-02-10 | Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not pr… |
CVE-2026-21529 | Medium | 5.7 | 2026-02-10 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over… |
CVE-2025-52436 | High | 8.8 | 2026-02-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-11004 | | 2026-02-10 | The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same netw… | |
CVE-2026-1922 | Medium | 6.4 | 2026-02-10 | The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `messa… |
CVE-2026-1866 | High | 7.2 | 2026-02-10 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32… |
CVE-2025-40587 | High | 7.6 | 2026-02-10 | A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitr… |
CVE-2026-2099 | Medium | 5.4 | 2026-02-10 | AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes… |
CVE-2026-2098 | Medium | 6.1 | 2026-02-10 | AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript c… |
CVE-2026-0996 | Medium | 6.4 | 2026-02-10 | The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI Form Builder module in all versions up to, and including, 6.1.14… |
CVE-2026-24325 | Medium | 4.8 | 2026-02-10 | SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an… |
CVE-2026-0505 | Medium | 6.1 | 2026-02-10 | The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unval… |
CVE-2026-25496 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exis… |
CVE-2026-25491 | Medium | 4.8 | 2026-02-09 | Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when dis… |
CVE-2026-25230 | Medium | 4.6 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and… |
CVE-2025-63354 | Medium | 4.8 | 2026-02-09 | Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing a… |
CVE-2026-1960 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint. | |
CVE-2026-1959 | | 2026-02-09 | Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'descripción' parameter in the '/loggrodemo/jbrain/MaestraCuentasBancarias' endpoin… | |
CVE-2026-25847 | High | 8.2 | 2026-02-09 | In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible |
CVE-2026-2224 | Low | 3.5 | 2026-02-09 | A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_funct… |
CVE-2025-7799 | High | 8.6 | 2026-02-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Acc… |
CVE-2026-2222 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/syst… |
CVE-2026-2214 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. This manipulatio… |
CVE-2026-2201 | Low | 2.4 | 2026-02-09 | A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the… |
CVE-2026-2200 | Low | 2.4 | 2026-02-09 | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Execut… |
CVE-2026-2160 | Medium | 4.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-2159 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=regist… |
CVE-2026-2156 | Low | 2.4 | 2026-02-08 | A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announceme… |
CVE-2026-2154 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /… |
CVE-2026-2150 | Medium | 4.3 | 2026-02-08 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2026-2149 | Medium | 4.3 | 2026-02-08 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2026-2145 | Low | 3.5 | 2026-02-08 | A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the componen… |
CVE-2026-1643 | Medium | 6.1 | 2026-02-07 | The MP-Ukagaka plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.5.2 due to insufficient input sanit… |
CVE-2026-1634 | Medium | 6.1 | 2026-02-07 | The Subitem AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and… |
CVE-2026-1613 | Medium | 6.4 | 2026-02-07 | The Wonka Slide plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `list_class` shortcode in all versions up to, and including… |
CVE-2026-1611 | Medium | 6.4 | 2026-02-07 | The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all versions up to, and… |
CVE-2026-1608 | Medium | 6.4 | 2026-02-07 | The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up to, and including… |
CVE-2026-1573 | Medium | 6.4 | 2026-02-07 | The OMIGO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `omigo_donate_button` shortcode in all versions up to, and includi… |
CVE-2026-1570 | Medium | 6.4 | 2026-02-07 | The Simple Bible Verse via Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `verse` shortcode in all versions up to… |
CVE-2026-0555 | Medium | 6.4 | 2026-02-07 | The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and inc… |
CVE-2025-15267 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to… |
CVE-2025-13463 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3… |
CVE-2025-12159 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and… |
CVE-2026-25516 | Medium | 6.1 | 2026-02-06 | NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then rendered via… |
CVE-2026-25581 | Medium | 5.4 | 2026-02-06 | SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.crea… |
CVE-2026-2064 | Low | 3.5 | 2026-02-06 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.ph… |
CVE-2026-25642 | Medium | 4.3 | 2026-02-06 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more… |
CVE-2026-25640 | High | 7.1 | 2026-02-06 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerabili… |
CVE-2026-22254 | Unrated | | 2026-02-06 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access… |
CVE-2026-25647 | Medium | 4.6 | 2026-02-06 | Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-24050 | Medium | 5.4 | 2026-02-06 | Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible to stored XSS in gro… |
CVE-2026-24903 | Medium | 5.4 | 2026-02-06 | OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Se… |
CVE-2026-1769 | Medium | 5.3 | 2026-02-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This… |
CVE-2026-23738 | Low | 3.5 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/con… |
CVE-2019-25301 | Medium | 6.4 | 2026-02-06 | Millhouse-Project 1.414 contains a persistent cross-site scripting vulnerability in the comment submission functionality that allows attackers to inject malici… |
CVE-2019-25294 | Medium | 6.1 | 2026-02-06 | html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through the 'Remark' parameter in ad… |
CVE-2025-13523 | High | 7.7 | 2026-02-06 | Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Conflu… |
CVE-2026-1293 | Medium | 6.4 | 2026-02-06 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schem… |
CVE-2026-1252 | Medium | 6.4 | 2026-02-06 | The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including… |
CVE-2026-1279 | Medium | 6.4 | 2026-02-06 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shor… |
CVE-2026-1909 | Medium | 6.4 | 2026-02-06 | The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's audio shortcode in all versions up to, and including, 2.8… |
CVE-2026-1888 | Medium | 6.4 | 2026-02-06 | The Docus – YouTube Video Playlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'docusplaylist' shortcode in all versions up to, a… |
CVE-2026-1808 | Medium | 6.4 | 2026-02-06 | The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' parameter of the ocpl… |
CVE-2026-1401 | Medium | 6.4 | 2026-02-06 | The Tune Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSV import in all versions up to, and including, 1.6.3. This is due to i… |
CVE-2026-0521 | Medium | 6.1 | 2026-02-06 | A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated attackers to craft a… |
CVE-2026-1971 | Low | 2.4 | 2026-02-06 | A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation… |
CVE-2025-70792 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafte… |
CVE-2025-70791 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in… |
CVE-2025-68723 | Critical | 9.0 | 2026-02-05 | Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the… |
CVE-2025-68643 | Medium | 5.4 | 2026-02-05 | Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploi… |
CVE-2020-37152 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize us… |
CVE-2020-37148 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not… |
CVE-2026-1654 | Medium | 6.1 | 2026-02-05 | The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to… |
CVE-2026-1319 | Medium | 6.4 | 2026-02-05 | The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternativ… |
CVE-2026-1953 | | 2026-02-05 | Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The… | |
CVE-2026-1268 | Medium | 6.4 | 2026-02-05 | The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in al… |
CVE-2026-0867 | Medium | 6.4 | 2026-02-05 | The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-me… |
CVE-2026-25578 | Medium | 6.1 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allow… |
CVE-2026-25543 | Medium | 6.1 | 2026-02-04 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-b… |
CVE-2026-0947 | Medium | 4.8 | 2026-02-04 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scri… |
CVE-2026-0946 | Medium | 6.1 | 2026-02-04 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (… |
CVE-2026-25054 | Medium | 5.4 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rende… |
CVE-2026-25051 | Medium | 5.4 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of… |
CVE-2026-20111 | Medium | 4.8 | 2026-02-04 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-sit… |
CVE-2025-70545 | Medium | 6.1 | 2026-02-04 | A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The… |
CVE-2026-0873 | | 2026-02-04 | On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an aut… | |
CVE-2025-41085 | | 2026-02-04 | Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attacker… | |
CVE-2026-0743 | Medium | 4.4 | 2026-02-04 | The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and includ… |
CVE-2026-0742 | Medium | 6.4 | 2026-02-04 | The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form_data AJAX action in all versions up to… |