CWE-79 · Cross-site Scripting (page 50)
Page 50 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15283 | High | 7.2 | 2026-01-14 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters… |
CVE-2025-15266 | High | 7.2 | 2026-01-14 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat m… |
CVE-2025-15021 | Medium | 4.4 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 d… |
CVE-2025-14725 | Medium | 4.4 | 2026-01-14 | The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to… |
CVE-2025-14379 | Medium | 4.4 | 2026-01-14 | The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitiza… |
CVE-2025-13627 | Medium | 4.4 | 2026-01-14 | The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in all versions up to, and including, 0.1 du… |
CVE-2025-12178 | Medium | 6.4 | 2026-01-14 | The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and includi… |
CVE-2023-54341 | Medium | 6.1 | 2026-01-13 | Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file… |
CVE-2023-54332 | Medium | 6.1 | 2026-01-13 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id par… |
CVE-2023-53985 | Medium | 6.1 | 2026-01-13 | Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through u… |
CVE-2022-50937 | Medium | 6.1 | 2026-01-13 | Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malici… |
CVE-2022-50908 | High | 7.2 | 2026-01-13 | Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can s… |
CVE-2022-50906 | Medium | 4.8 | 2026-01-13 | e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media man… |
CVE-2022-50905 | Critical | 9.8 | 2026-01-13 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs… |
CVE-2022-50896 | Medium | 6.1 | 2026-01-13 | Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Atta… |
CVE-2022-50891 | Medium | 5.0 | 2026-01-13 | Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP… |
CVE-2021-47750 | Medium | 6.1 | 2026-01-13 | YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the sign… |
CVE-2020-36919 | Medium | 6.1 | 2026-01-13 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts throu… |
CVE-2025-68658 | Medium | 4.3 | 2026-01-13 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 ha… |
CVE-2025-15056 | Medium | 6.1 | 2026-01-13 | A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3. |
CVE-2026-20959 | Medium | 4.6 | 2026-01-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2025-9427 | | 2026-01-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scrip… | |
CVE-2026-0514 | Medium | 6.1 | 2026-01-13 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting use… |
CVE-2026-0499 | Medium | 6.1 | 2026-01-13 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server re… |
CVE-2026-22813 | Medium | 6.1 | 2026-01-12 | OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with… |
CVE-2026-22804 | High | 8.0 | 2026-01-12 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting… |
CVE-2026-22033 | Medium | 5.4 | 2026-01-12 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in t… |
CVE-2025-66939 | Medium | 5.4 | 2026-01-12 | Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file |
CVE-2025-41003 | | 2026-01-12 | Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.ph… | |
CVE-2025-40978 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by se… | |
CVE-2025-40977 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request… | |
CVE-2025-40976 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ti… | |
CVE-2025-40975 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo… | |
CVE-2025-69275 | Medium | 6.1 | 2026-01-12 | Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps… |
CVE-2025-69268 | Medium | 6.1 | 2026-01-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allo… |
CVE-2025-15505 | Low | 2.4 | 2026-01-11 | A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipula… |
CVE-2026-0824 | Low | 3.5 | 2026-01-10 | A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross… |
CVE-2025-12379 | Medium | 6.4 | 2026-01-10 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a combination of the 'tag' and ‘title_t… |
CVE-2025-14555 | Medium | 6.4 | 2026-01-10 | The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in all… |
CVE-2025-14506 | Medium | 6.4 | 2026-01-10 | The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in al… |
CVE-2026-22704 | High | 8.0 | 2026-01-10 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead… |
CVE-2026-22610 | Medium | 6.1 | 2026-01-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18… |
CVE-2025-61676 | Medium | 6.1 | 2026-01-10 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified… |
CVE-2025-61674 | Medium | 6.1 | 2026-01-10 | October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified i… |
CVE-2026-22029 | High | 8.0 | 2026-01-10 | React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open… |
CVE-2026-21884 | High | 8.2 | 2026-01-10 | React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React… |
CVE-2025-59057 | High | 7.6 | 2026-01-10 | React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exis… |
CVE-2026-22198 | Medium | 6.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sendin… |
CVE-2025-13967 | Medium | 6.4 | 2026-01-09 | The Woodpecker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_name' parameter of the [woodpecker-connector] shor… |
CVE-2025-13908 | Medium | 6.4 | 2026-01-09 | The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions up to, and including… |
CVE-2025-13903 | Medium | 6.4 | 2026-01-09 | The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to, and including, 1… |
CVE-2025-13897 | Medium | 6.4 | 2026-01-09 | The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aft_testimonial_meta_name' custom field in the Client… |
CVE-2025-13893 | Medium | 6.1 | 2026-01-09 | The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and in… |
CVE-2025-13892 | Medium | 6.1 | 2026-01-09 | The MG AdvancedOptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-13862 | Medium | 6.4 | 2026-01-09 | The Menu Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `category` parameter in all versions up to, and including, 0.8.0 due to… |
CVE-2025-13854 | Medium | 6.4 | 2026-01-09 | The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, an… |
CVE-2025-13852 | Medium | 6.4 | 2026-01-09 | The Debt.com Business in a Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configuration' parameter of the lead_form shortcode i… |
CVE-2025-13704 | Medium | 6.4 | 2026-01-09 | The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' parameter of the 'autogen_menu' shortcode in al… |
CVE-2025-13701 | Medium | 6.1 | 2026-01-09 | The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter in all versions up to, and includ… |
CVE-2025-11453 | Medium | 6.4 | 2026-01-09 | The Header and Footer Scripts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _inpost_head_script parameter in all versions up to, an… |
CVE-2025-9222 | High | 8.7 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have all… |
CVE-2025-13900 | Medium | 6.4 | 2026-01-09 | The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the [wppum_end] shortcode in all versions up t… |
CVE-2025-13895 | Medium | 6.1 | 2026-01-09 | The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up… |
CVE-2025-13853 | Medium | 6.4 | 2026-01-09 | The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions… |
CVE-2025-13761 | High | 8.0 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticate… |
CVE-2025-13729 | Medium | 6.4 | 2026-01-09 | The Entry Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'entry-views' shortcode in all versions up to, and including… |
CVE-2026-0627 | Medium | 6.4 | 2026-01-09 | The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10. This is due… |
CVE-2025-14937 | High | 7.2 | 2026-01-09 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update… |
CVE-2026-0563 | Medium | 6.4 | 2026-01-09 | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_m… |
CVE-2025-15057 | High | 7.2 | 2026-01-09 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and includ… |
CVE-2025-15055 | High | 7.2 | 2026-01-09 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and i… |
CVE-2025-15019 | Medium | 6.4 | 2026-01-09 | The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2025-14893 | Medium | 6.4 | 2026-01-09 | The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to… |
CVE-2025-14803 | Medium | 6.8 | 2026-01-09 | The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured… |
CVE-2026-22714 | | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin a… | |
CVE-2026-22713 | Medium | 5.4 | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperim… |
CVE-2026-22710 | Medium | 5.4 | 2026-01-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Exte… |
CVE-2026-0730 | Low | 2.4 | 2026-01-08 | A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UPDATE_STAFF of the file /staffleave/slms… |
CVE-2025-14436 | High | 7.2 | 2026-01-08 | The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all versions up to, and i… |
CVE-2026-22257 | High | 8.8 | 2026-01-08 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folder… |
CVE-2026-22256 | High | 8.8 | 2026-01-08 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current… |
CVE-2026-22587 | Medium | 5.5 | 2026-01-08 | Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a payload in the 'Reports' page that execut… |
CVE-2026-22233 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever a… |
CVE-2026-22232 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is… |
CVE-2026-22231 | Medium | 5.5 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whe… |
CVE-2026-22519 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This iss… |
CVE-2026-22518 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows… |
CVE-2026-0671 | Medium | 6.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard exte… |
CVE-2025-61550 | Medium | 5.4 | 2026-01-08 | Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Busine… |
CVE-2025-61549 | Medium | 6.1 | 2026-01-08 | Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDes… |
CVE-2025-63611 | High | 8.7 | 2026-01-08 | Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php a… |
CVE-2026-21873 | High | 7.2 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an… |
CVE-2026-21872 | Medium | 6.1 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with… |
CVE-2026-21871 | Medium | 6.1 | 2026-01-08 | NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui… |
CVE-2025-68892 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerp… |
CVE-2025-68891 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.Th… |
CVE-2025-68890 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This i… |
CVE-2025-68889 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue a… |
CVE-2025-68887 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-Busin… |
CVE-2025-68875 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset… |