CWE-79 · Cross-site Scripting (page 51)
Page 51 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68874 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows… |
CVE-2025-68873 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigita… |
CVE-2025-68867 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Base… |
CVE-2025-67933 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS… |
CVE-2025-67932 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.T… |
CVE-2025-67930 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows R… |
CVE-2025-67927 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflec… |
CVE-2025-67922 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflec… |
CVE-2025-67918 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue… |
CVE-2025-67916 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue… |
CVE-2025-27004 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gal… |
CVE-2025-27002 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background cou… |
CVE-2025-22725 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Store… |
CVE-2025-14984 | Medium | 6.4 | 2026-01-08 | The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is… |
CVE-2025-13504 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflecte… |
CVE-2025-12551 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This… |
CVE-2025-14275 | Medium | 6.4 | 2026-01-08 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input s… |
CVE-2019-25284 | Medium | 6.1 | 2026-01-08 | V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parame… |
CVE-2019-25280 | Medium | 6.1 | 2026-01-08 | Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the 'speed' GET parameter. A… |
CVE-2019-25277 | Medium | 6.1 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to injec… |
CVE-2019-25270 | Medium | 6.1 | 2026-01-08 | SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logged_page.php that allows attackers to in… |
CVE-2025-12776 | Medium | 5.4 | 2026-01-07 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible… |
CVE-2026-21855 | Critical | 9.3 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast n… |
CVE-2026-0670 | Medium | 6.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Ext… |
CVE-2026-0618 | Medium | 6.1 | 2026-01-07 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. |
CVE-2025-66686 | Medium | 6.1 | 2026-01-07 | A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject maliciou… |
CVE-2025-15479 | Medium | 5.4 | 2026-01-07 | Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on… |
CVE-2025-46494 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue… |
CVE-2026-0642 | Low | 2.4 | 2026-01-07 | A vulnerability was detected in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /app/complaint.php… |
CVE-2025-69082 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects… |
CVE-2025-32300 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XS… |
CVE-2025-15000 | Medium | 4.4 | 2026-01-07 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to… |
CVE-2025-14891 | Medium | 6.4 | 2026-01-07 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, a… |
CVE-2025-14888 | Medium | 4.4 | 2026-01-07 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and includin… |
CVE-2025-14887 | Medium | 4.4 | 2026-01-07 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all ve… |
CVE-2025-14875 | Medium | 6.1 | 2026-01-07 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up… |
CVE-2025-14796 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4. This is du… |
CVE-2025-14626 | Medium | 6.4 | 2026-01-07 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortc… |
CVE-2025-14453 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and inclu… |
CVE-2025-14147 | Medium | 6.4 | 2026-01-07 | The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions… |
CVE-2025-14145 | Medium | 6.4 | 2026-01-07 | The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh… |
CVE-2025-14144 | Medium | 6.4 | 2026-01-07 | The Mstoic Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'start' parameter of the ms_youtube_embeds shortcode in all ver… |
CVE-2025-14131 | Medium | 6.1 | 2026-01-07 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14130 | Medium | 6.1 | 2026-01-07 | The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14128 | Medium | 6.1 | 2026-01-07 | The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14127 | Medium | 6.1 | 2026-01-07 | The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14122 | Medium | 6.4 | 2026-01-07 | The AD Sliding FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliding_faq' shortcode in all versions up to, and including, 2.4… |
CVE-2025-14121 | Medium | 6.4 | 2026-01-07 | The EDD Download Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'edd_download_info_link' shortcode in all versions up to, and i… |
CVE-2025-14118 | Medium | 6.1 | 2026-01-07 | The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 d… |
CVE-2025-14114 | Medium | 6.4 | 2026-01-07 | The 1180px Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and includin… |
CVE-2025-14113 | Medium | 6.4 | 2026-01-07 | The Viitor Button Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' shortcode attribute in all versions up to, and in… |
CVE-2025-14112 | Medium | 6.4 | 2026-01-07 | The Snillrik Restaurant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'menu_style' shortcode attribute in all versions up to, and i… |
CVE-2025-14110 | Medium | 6.4 | 2026-01-07 | The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, an… |
CVE-2025-14109 | Medium | 6.4 | 2026-01-07 | The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including… |
CVE-2025-14057 | Medium | 4.4 | 2026-01-07 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 17.0.39 due… |
CVE-2025-14053 | Medium | 6.4 | 2026-01-07 | The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to in… |
CVE-2025-14028 | Medium | 4.4 | 2026-01-07 | The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due t… |
CVE-2025-13974 | Medium | 4.4 | 2026-01-07 | The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and in… |
CVE-2025-13887 | Medium | 6.4 | 2026-01-07 | The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_bot… |
CVE-2025-13849 | Medium | 6.4 | 2026-01-07 | The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due… |
CVE-2025-13848 | Medium | 6.4 | 2026-01-07 | The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to, and including, 0.9… |
CVE-2025-13847 | Medium | 6.4 | 2026-01-07 | The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to ins… |
CVE-2025-13841 | Medium | 6.4 | 2026-01-07 | The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-downloa… |
CVE-2025-13667 | Medium | 6.4 | 2026-01-07 | The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including… |
CVE-2025-13531 | Medium | 6.4 | 2026-01-07 | The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and in… |
CVE-2025-13497 | Medium | 6.4 | 2026-01-07 | The Recras WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'recrasname' shortcode attribute in all versions up to, and incl… |
CVE-2025-13418 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and includ… |
CVE-2025-13369 | Medium | 6.1 | 2026-01-07 | The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to'… |
CVE-2025-31642 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue aff… |
CVE-2025-30631 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon… |
CVE-2025-13744 | Medium | 5.4 | 2026-01-06 | An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML t… |
CVE-2025-69362 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue aff… |
CVE-2025-69360 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-e… |
CVE-2025-69357 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-… |
CVE-2025-69350 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.Thi… |
CVE-2025-69335 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS… |
CVE-2025-69334 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2025-69085 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue… |
CVE-2025-69084 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Re… |
CVE-2025-63083 | Medium | 6.1 | 2026-01-06 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. |
CVE-2025-63082 | Medium | 6.1 | 2026-01-06 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. |
CVE-2024-31088 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSen… |
CVE-2024-30547 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider al… |
CVE-2025-14552 | Medium | 6.4 | 2026-01-06 | The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including… |
CVE-2025-12067 | Medium | 6.4 | 2026-01-06 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and… |
CVE-2025-4776 | Medium | 6.4 | 2026-01-06 | The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 d… |
CVE-2025-14120 | Medium | 6.4 | 2026-01-06 | The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due t… |
CVE-2025-13746 | Medium | 6.4 | 2026-01-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and… |
CVE-2025-66648 | High | 7.2 | 2026-01-05 | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user… |
CVE-2025-65110 | High | 8.1 | 2026-01-05 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, a… |
CVE-2025-59158 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 a… |
CVE-2025-55204 | High | 8.8 | 2026-01-05 | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attack… |
CVE-2025-67316 | Medium | 5.4 | 2026-01-05 | An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser… |
CVE-2025-59467 | High | 7.5 | 2026-01-05 | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator… |
CVE-2025-39497 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka… |
CVE-2024-53735 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager al… |
CVE-2024-30461 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-12513 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration for… |
CVE-2025-12511 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configura… |