CWE-79 · Cross-site Scripting (page 5)
Page 5 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97279 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
CVE-2026-97272 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. |
CVE-2026-97271 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
CVE-2026-97270 | Medium | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. |
CVE-2026-97266 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. |
CVE-2026-97262 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. |
CVE-2026-97253 | High | 7.1 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue af… |
CVE-2026-97250 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
CVE-2026-97238 | Medium | 5.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
CVE-2026-97237 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
CVE-2026-97236 | Medium | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
CVE-2026-97235 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
CVE-2026-97077 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
CVE-2026-97067 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. |
CVE-2026-97065 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. |
CVE-2026-96836 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. |
CVE-2026-96835 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions. |
CVE-2026-96830 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. |
CVE-2026-96829 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions. |
CVE-2026-96820 | High | 7.1 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. |
CVE-2026-96819 | High | 7.1 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. |
CVE-2026-96816 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions. |
CVE-2026-96814 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions. |
CVE-2026-96450 | Medium | 5.4 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. |
CVE-2026-96352 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions. |
CVE-2026-96351 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions. |
CVE-2026-96338 | Medium | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. |
CVE-2026-94674 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions. |
CVE-2026-94081 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions. |
CVE-2026-94078 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. |
CVE-2026-94077 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. |
CVE-2026-93770 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions. |
CVE-2026-93514 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions. |
CVE-2026-93512 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions. |
CVE-2026-62080 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions. |
CVE-2026-62079 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions. |
CVE-2026-62078 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. |
CVE-2026-27371 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
CVE-2026-103321 | | 2026-09-30 | MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored w… | |
CVE-2026-102398 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions. |
CVE-2026-102396 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions. |
CVE-2026-102395 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. |
CVE-2026-102386 | Medium | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. |
CVE-2026-102385 | High | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
CVE-2026-102384 | Medium | 5.9 | 2026-09-30 | Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
CVE-2026-100513 | Medium | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. |
CVE-2026-100507 | High | 7.1 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2026-97347 | High | 7.2 | 2026-09-30 | The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1… |
CVE-2026-93908 | Medium | 6.4 | 2026-09-30 | The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' p… |
CVE-2026-92712 | Medium | 6.4 | 2026-09-30 | The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions… |
CVE-2026-102586 | Medium | 4.3 | 2026-09-30 | A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (… |
CVE-2026-102581 | Medium | 4.6 | 2026-09-30 | A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An… |
CVE-2026-102459 | Medium | 6.1 | 2026-09-30 | EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes… |
CVE-2025-14564 | Medium | 6.4 | 2026-09-30 | The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0… |
CVE-2026-93464 | Medium | 5.4 | 2026-09-30 | A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be… |
CVE-2026-93463 | Medium | 5.4 | 2026-09-30 | A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed i… |
CVE-2026-93460 | Medium | 5.4 | 2026-09-30 | A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary scri… |
CVE-2026-88037 | Medium | 6.4 | 2026-09-30 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versi… |
CVE-2026-6173 | Medium | 6.4 | 2026-09-30 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shor… |
CVE-2026-6172 | Medium | 6.4 | 2026-09-30 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in al… |
CVE-2026-6171 | Medium | 6.4 | 2026-09-30 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all… |
CVE-2026-6170 | Medium | 6.4 | 2026-09-30 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortco… |
CVE-2026-14876 | Medium | 6.4 | 2026-09-30 | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1… |
CVE-2026-11895 | Medium | 6.4 | 2026-09-30 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displ… |
CVE-2026-92994 | High | 8.8 | 2026-09-30 | The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serv… |
CVE-2026-92424 | Medium | 6.8 | 2026-09-30 | The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they se… |
CVE-2026-91832 | High | 7.1 | 2026-09-30 | The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu… |
CVE-2026-89193 | High | 7.5 | 2026-09-30 | The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-defaul… |
CVE-2026-87777 | Medium | 6.8 | 2026-09-30 | The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users wit… |
CVE-2026-85573 | High | 8.8 | 2026-09-30 | The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authe… |
CVE-2026-85415 | Medium | 6.8 | 2026-09-30 | The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with… |
CVE-2026-85001 | Medium | 6.8 | 2026-09-30 | The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, wh… |
CVE-2026-82127 | Low | 3.5 | 2026-09-30 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them w… |
CVE-2026-96649 | High | 7.2 | 2026-09-30 | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via p… |
CVE-2026-102847 | Medium | 4.3 | 2026-09-30 | A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file… |
CVE-2026-103051 | Medium | 6.1 | 2026-09-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extens… |
CVE-2026-103050 | Medium | 6.1 | 2026-09-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extensio… |
CVE-2026-103049 | Medium | 6.1 | 2026-09-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allo… |
CVE-2026-103047 | Medium | 6.1 | 2026-09-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extensio… |
CVE-2026-103046 | Medium | 6.1 | 2026-09-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension all… |
CVE-2026-103045 | Medium | 6.1 | 2026-09-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allow… |
CVE-2026-84409 | High | 7.5 | 2026-09-29 | The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A… |
CVE-2026-71189 | Low | 3.5 | 2026-09-29 | An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user… |
CVE-2026-102329 | Medium | 6.1 | 2026-09-29 | Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafte… |
CVE-2024-31027 | Medium | 5.4 | 2026-09-29 | Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the… |
CVE-2026-102831 | High | 8.1 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5… |
CVE-2026-102830 | Medium | 6.8 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5… |
CVE-2026-92232 | Medium | 6.5 | 2026-09-29 | Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanA… |
CVE-2026-92231 | Medium | 6.7 | 2026-09-29 | Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute me… |
CVE-2026-92225 | Medium | 6.7 | 2026-09-29 | Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values… |
CVE-2026-92224 | Medium | 6.7 | 2026-09-29 | Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, lead… |
CVE-2026-90918 | Medium | 5.3 | 2026-09-29 | Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causi… |
CVE-2026-90914 | Medium | 6.4 | 2026-09-29 | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability… |
CVE-2026-90906 | High | 8.3 | 2026-09-29 | Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link metho… |
CVE-2026-101127 | Critical | 9.4 | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded… |
CVE-2026-100245 | Medium | 6.1 | 2026-09-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extensio… |
CVE-2026-100243 | Medium | 6.1 | 2026-09-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension… |
CVE-2026-100238 | Medium | 6.1 | 2026-09-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension al… |
CVE-2026-97711 | | 2026-09-29 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function value… | |
CVE-2026-49243 | Critical | 9.6 | 2026-09-29 | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are… |