CWE-79 · Cross-site Scripting (page 46)
Page 46 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47913 | Medium | 6.4 | 2026-02-01 | PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers… |
CVE-2021-47912 | Medium | 6.4 | 2026-02-01 | PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject… |
CVE-2021-47911 | Medium | 5.4 | 2026-02-01 | Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields. Attackers can inject malicious scripts t… |
CVE-2021-47908 | Medium | 6.4 | 2026-02-01 | Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious script… |
CVE-2021-47885 | Medium | 6.4 | 2026-02-01 | Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields. Attackers can i… |
CVE-2021-47856 | Medium | 6.4 | 2026-02-01 | Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject… |
CVE-2025-14554 | High | 7.2 | 2026-01-31 | The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all… |
CVE-2026-25156 | High | 7.3 | 2026-01-30 | HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition… |
CVE-2020-37044 | Medium | 5.4 | 2026-01-30 | OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sen… |
CVE-2026-25154 | Medium | 6.1 | 2026-01-30 | LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet con… |
CVE-2026-1705 | Low | 2.4 | 2026-01-30 | A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interfac… |
CVE-2026-1700 | Low | 3.5 | 2026-01-30 | A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This m… |
CVE-2020-37022 | Medium | 6.4 | 2026-01-30 | OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attackers can inject malici… |
CVE-2020-37019 | Medium | 6.4 | 2026-01-30 | Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation… |
CVE-2020-37014 | Medium | 6.4 | 2026-01-30 | Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. At… |
CVE-2020-37003 | Medium | 6.4 | 2026-01-30 | Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers to inject malicious… |
CVE-2020-36998 | Medium | 6.4 | 2026-01-30 | Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject… |
CVE-2020-36996 | Medium | 6.4 | 2026-01-30 | PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content… |
CVE-2020-36966 | Medium | 6.4 | 2026-01-30 | Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts thr… |
CVE-2026-24855 | Medium | 5.4 | 2026-01-30 | ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) vulnerability occurs in Create Events in… |
CVE-2025-9226 | Medium | 4.6 | 2026-01-30 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subn… |
CVE-2026-25117 | | 2026-01-29 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspa… | |
CVE-2025-15549 | Medium | 4.8 | 2026-01-29 | FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via t… |
CVE-2025-69749 | Medium | 6.1 | 2026-01-29 | Cross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code. |
CVE-2026-1598 | Low | 3.5 | 2026-01-29 | A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/… |
CVE-2025-7713 | High | 7.5 | 2026-01-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Cont… |
CVE-2020-37018 | Medium | 6.4 | 2026-01-29 | GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through message subjects… |
CVE-2026-1469 | Medium | 5.4 | 2026-01-29 | Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by inject… |
CVE-2026-24769 | Critical | 9.0 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attac… |
CVE-2025-13983 | Medium | 5.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-13981 | Medium | 4.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2025-13979 | Medium | 5.4 | 2026-01-28 | Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. |
CVE-2026-0749 | Medium | 6.1 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-67723 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-sit… |
CVE-2025-70336 | Medium | 4.8 | 2026-01-28 | A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTM… |
CVE-2026-1520 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such ma… |
CVE-2025-14865 | Medium | 6.4 | 2026-01-28 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortc… |
CVE-2020-36993 | Medium | 5.4 | 2026-01-28 | LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malic… |
CVE-2020-36988 | Medium | 5.4 | 2026-01-28 | PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts… |
CVE-2026-1399 | Medium | 4.4 | 2026-01-28 | The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1… |
CVE-2026-1391 | Medium | 5.3 | 2026-01-28 | The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient i… |
CVE-2026-0483 | | 2026-01-28 | Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a mali… | |
CVE-2025-59900 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59899 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59898 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59897 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59896 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-14283 | Medium | 6.4 | 2026-01-28 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored C… |
CVE-2025-14063 | Medium | 6.1 | 2026-01-28 | The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and inc… |
CVE-2026-1381 | Medium | 4.4 | 2026-01-28 | The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, a… |
CVE-2026-1053 | Medium | 4.4 | 2026-01-28 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl… |
CVE-2026-1466 | Medium | 6.1 | 2026-01-28 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scri… |
CVE-2026-1295 | Medium | 6.4 | 2026-01-28 | The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions… |
CVE-2026-1244 | Medium | 6.4 | 2026-01-28 | The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in the 'financoop_c… |
CVE-2025-9082 | Medium | 6.4 | 2026-01-28 | The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and includi… |
CVE-2025-14039 | Medium | 6.4 | 2026-01-28 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta… |
CVE-2025-12709 | Medium | 6.4 | 2026-01-28 | The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in… |
CVE-2026-1083 | Medium | 4.4 | 2026-01-28 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in al… |
CVE-2025-8072 | Medium | 6.4 | 2026-01-28 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and… |
CVE-2026-1513 | Medium | 6.1 | 2026-01-28 | billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding. |
CVE-2026-24838 | Critical | 9.1 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module tit… |
CVE-2026-24837 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2026-24836 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2026-24833 | High | 7.6 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module co… |
CVE-2026-24784 | Medium | 6.8 | 2026-01-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9… |
CVE-2026-24778 | High | 8.8 | 2026-01-27 | Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious… |
CVE-2026-24771 | Medium | 4.7 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exist… |
CVE-2020-36978 | Medium | 6.4 | 2026-01-27 | Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject ma… |
CVE-2026-24348 | Medium | 6.1 | 2026-01-27 | Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScript code in the brow… |
CVE-2026-24824 | | 2026-01-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in yacy yacy_search_server (source/net/yacy/http/serv… | |
CVE-2026-24490 | High | 8.1 | 2026-01-27 | MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest… |
CVE-2026-24476 | Medium | 5.4 | 2026-01-26 | Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the… |
CVE-2026-1444 | Low | 2.4 | 2026-01-26 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers… |
CVE-2025-11687 | Medium | 6.1 | 2026-01-26 | A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie th… |
CVE-2025-70368 | Medium | 5.4 | 2026-01-26 | Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in… |
CVE-2026-24433 | Medium | 5.4 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functio… |
CVE-2026-1446 | Medium | 5.0 | 2026-01-26 | There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to… |
CVE-2020-36960 | Medium | 6.4 | 2026-01-26 | Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fiel… |
CVE-2020-36956 | Medium | 6.4 | 2026-01-26 | Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' p… |
CVE-2020-36955 | Medium | 6.4 | 2026-01-26 | Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scrip… |
CVE-2020-36954 | Medium | 6.4 | 2026-01-26 | Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject m… |
CVE-2026-1429 | Medium | 5.4 | 2026-01-26 | Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arb… |
CVE-2026-1421 | Low | 3.5 | 2026-01-26 | A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation le… |
CVE-2020-36932 | Medium | 6.1 | 2026-01-25 | SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScri… |
CVE-2020-36931 | Medium | 6.4 | 2026-01-25 | Click2Magic 1.1.5 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts in the chat name input. Attackers can… |
CVE-2026-0862 | Medium | 6.1 | 2026-01-24 | The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all versions up to, and… |
CVE-2026-1302 | Medium | 4.4 | 2026-01-24 | The Meta-box GalleryMeta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due t… |
CVE-2026-1300 | Medium | 4.4 | 2026-01-24 | The Responsive Header plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple plugin settings parameters in all versions up to, and incl… |
CVE-2026-1266 | Medium | 4.4 | 2026-01-24 | The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insuff… |
CVE-2026-1191 | Medium | 4.4 | 2026-01-24 | The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 1.2.8. This… |
CVE-2026-1189 | Medium | 6.4 | 2026-01-24 | The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbi_form' shortcode in… |
CVE-2026-1127 | Medium | 6.1 | 2026-01-24 | The Timeline Event History plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `id` parameter in all versions up to, and including, 3… |
CVE-2026-1098 | Medium | 6.4 | 2026-01-24 | The CM CSS Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to, and including, 1… |
CVE-2026-0800 | High | 7.2 | 2026-01-24 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fie… |
CVE-2026-1099 | Medium | 6.4 | 2026-01-24 | The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versio… |
CVE-2026-1097 | Medium | 6.4 | 2026-01-24 | The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' s… |
CVE-2026-1095 | Medium | 6.4 | 2026-01-24 | The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including… |
CVE-2026-1084 | Medium | 4.4 | 2026-01-24 | The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and inc… |
CVE-2025-14985 | Medium | 6.4 | 2026-01-24 | The Alpha Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alpha_block_css’ parameter in all versions up to, and including, 1… |
CVE-2025-14941 | Medium | 6.4 | 2026-01-24 | The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This… |