CWE-79 · Cross-site Scripting (page 45)
Page 45 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0681 | Medium | 4.4 | 2026-02-04 | The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and inclu… |
CVE-2026-1819 | High | 8.8 | 2026-02-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Electronics Industry and Trade Inc. ViPort a… |
CVE-2026-22875 | Medium | 5.4 | 2026-02-04 | Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed… |
CVE-2026-21393 | Medium | 5.4 | 2026-02-04 | Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed… |
CVE-2026-1755 | Medium | 6.4 | 2026-02-03 | The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_image_alt’ post meta in all versions up t… |
CVE-2025-36033 | Medium | 5.4 | 2026-02-03 | IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global… |
CVE-2020-37087 | | 2026-02-03 | Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by m… | |
CVE-2026-25148 | Medium | 6.1 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual att… |
CVE-2020-37072 | High | 7.2 | 2026-02-03 | Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. A… |
CVE-2026-24053 | Medium | 6.5 | 2026-02-03 | Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was possible to bypass… |
CVE-2026-25616 | Medium | 4.7 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665. |
CVE-2026-25522 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25490 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25489 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25488 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25487 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25486 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute ma… |
CVE-2026-25485 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commer… |
CVE-2026-25484 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type nam… |
CVE-2026-25483 | Medium | 5.4 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft… |
CVE-2026-25482 | Medium | 4.8 | 2026-02-03 | Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability exists in t… |
CVE-2026-24426 | Medium | 6.1 | 2026-02-03 | Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied… |
CVE-2026-24674 | Medium | 4.7 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS)… |
CVE-2026-24672 | High | 7.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24671 | Medium | 6.1 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vul… |
CVE-2026-24665 | High | 8.7 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vul… |
CVE-2025-71179 | Medium | 6.1 | 2026-02-03 | Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the str… |
CVE-2025-70849 | Medium | 6.1 | 2026-02-03 | Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The app… |
CVE-2025-69848 | Medium | 5.4 | 2026-02-03 | NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in ve… |
CVE-2025-65923 | Medium | 5.4 | 2026-02-03 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Records… |
CVE-2020-37111 | Medium | 6.1 | 2026-02-03 | 60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Atta… |
CVE-2020-37103 | Medium | 6.4 | 2026-02-03 | DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through… |
CVE-2019-25265 | Medium | 6.4 | 2026-02-03 | Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers ca… |
CVE-2019-25264 | Medium | 6.4 | 2026-02-03 | Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. At… |
CVE-2019-25263 | Medium | 6.4 | 2026-02-03 | Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket… |
CVE-2026-23794 | Medium | 6.8 | 2026-02-03 | Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduse… |
CVE-2026-24988 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-even… |
CVE-2026-24958 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2026-24952 | Medium | 6.5 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2026-24938 | Medium | 5.9 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This i… |
CVE-2025-7760 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Associatio… |
CVE-2025-6397 | High | 8.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software all… |
CVE-2025-67855 | Medium | 5.4 | 2026-02-03 | A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerabi… |
CVE-2025-67850 | High | 7.3 | 2026-02-03 | A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula edi… |
CVE-2025-67849 | High | 7.3 | 2026-02-03 | A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject m… |
CVE-2025-59902 | | 2026-02-03 | HTML injection vulnerability in NICE Chat. This vulnerability allows an attacker to inject and render arbitrary HTML content in email transcripts by modifying… | |
CVE-2025-41065 | | 2026-02-03 | Stored Cross-Site Scripting (XSS) vulnerability type in LUNA software v7.5.5.6. This vulnerability allows an attacker to execute JavaScript code in the victim'… | |
CVE-2025-8461 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This i… |
CVE-2025-8456 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Ind… |
CVE-2026-1592 | Medium | 6.3 | 2026-02-03 | Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded int… |
CVE-2026-1591 | Medium | 6.3 | 2026-02-03 | Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the u… |
CVE-2025-8589 | High | 7.6 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade In… |
CVE-2026-1210 | Medium | 6.4 | 2026-02-03 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, an… |
CVE-2026-1058 | High | 7.1 | 2026-02-03 | The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is… |
CVE-2026-0617 | High | 7.2 | 2026-02-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile… |
CVE-2025-14274 | Medium | 5.4 | 2026-02-03 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versio… |
CVE-2025-67483 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67481 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67477 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67475 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61657 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is… | |
CVE-2025-61656 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61655 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61651 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-61650 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… | |
CVE-2025-61648 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-61645 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-11261 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61644 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… | |
CVE-2025-61642 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61640 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61638 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2025-61637 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61636 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2026-25144 | Medium | 5.3 | 2026-02-02 | Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without s… |
CVE-2026-23997 | High | 8.0 | 2026-02-02 | FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability w… |
CVE-2026-23476 | Medium | 5.4 | 2026-02-02 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem i… |
CVE-2025-70960 | Medium | 5.4 | 2026-02-02 | A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via in… |
CVE-2025-70959 | Medium | 5.4 | 2026-02-02 | A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-70958 | Medium | 6.1 | 2026-02-02 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript… |
CVE-2025-6596 | | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is… | |
CVE-2025-6595 | Medium | 4.7 | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue a… |
CVE-2025-6594 | Medium | 4.7 | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-6591 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects… | |
CVE-2025-36436 | Medium | 6.4 | 2026-02-02 | IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 … |
CVE-2026-22881 | Medium | 5.4 | 2026-02-02 | Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. |
CVE-2026-20711 | Medium | 6.1 | 2026-02-02 | Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords. |
CVE-2025-15396 | High | 7.1 | 2026-02-02 | The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected C… |
CVE-2026-1744 | Low | 2.4 | 2026-02-02 | A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulat… |
CVE-2023-54343 | Medium | 6.4 | 2026-02-01 | QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path… |
CVE-2022-50952 | Medium | 6.4 | 2026-02-01 | Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject m… |
CVE-2022-50951 | Medium | 6.4 | 2026-02-01 | WiFi File Transfer 1.0.8 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through file an… |
CVE-2022-50942 | Medium | 5.4 | 2026-02-01 | Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.mi… |
CVE-2022-50941 | Medium | 6.4 | 2026-02-01 | BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkou… |
CVE-2022-50940 | Medium | 6.4 | 2026-02-01 | Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name… |
CVE-2022-50797 | Medium | 6.4 | 2026-02-01 | Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in… |
CVE-2021-47920 | Medium | 5.4 | 2026-02-01 | WebMO Job Manager 20.0 contains a cross-site scripting vulnerability in search parameters that allows remote attackers to inject malicious script code. Attacke… |
CVE-2021-47919 | Medium | 6.4 | 2026-02-01 | Simple CMS 2.1 contains a non-persistent cross-site scripting vulnerability in the preview.php file's id parameter. Attackers can inject malicious script code… |
CVE-2021-47917 | Medium | 6.4 | 2026-02-01 | Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote attackers to inject malicious script code… |
CVE-2021-47914 | Medium | 6.4 | 2026-02-01 | PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to injec… |