CWE-79 · Cross-site Scripting (page 53)
Page 53 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69092 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2025-69089 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XS… |
CVE-2025-69088 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows D… |
CVE-2025-69033 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.Th… |
CVE-2025-69020 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows St… |
CVE-2025-69019 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based X… |
CVE-2025-69018 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM… |
CVE-2025-69017 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This… |
CVE-2025-69008 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allo… |
CVE-2025-69007 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-side… |
CVE-2025-69006 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This is… |
CVE-2025-68992 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allow… |
CVE-2025-68991 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager a… |
CVE-2025-68978 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows D… |
CVE-2025-68977 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-po… |
CVE-2025-15355 | Medium | 6.1 | 2025-12-30 | ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrar… |
CVE-2025-15221 | Low | 3.5 | 2025-12-30 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. This vulnerability affects the function index of the file src/main/java/com/sohu/cache/web/controller/A… |
CVE-2025-15220 | Medium | 4.3 | 2025-12-30 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginCont… |
CVE-2025-15219 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/mai… |
CVE-2025-15214 | Low | 2.4 | 2025-12-30 | A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulati… |
CVE-2025-68499 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-23554 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO off-page-seo allows Reflected XSS… |
CVE-2025-23550 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller product-puller allows Reflect… |
CVE-2025-23469 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sleekplan Sleekplan sleekplan allows Reflected XSS.This i… |
CVE-2025-23458 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rakessh Ads24 Lite wp-ad-management allows Reflected XSS… |
CVE-2025-68607 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template custom-field-temp… |
CVE-2025-68504 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This… |
CVE-2025-15204 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/… |
CVE-2025-15203 | Low | 2.4 | 2025-12-29 | A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceCon… |
CVE-2025-15202 | Low | 2.4 | 2025-12-29 | A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controlle… |
CVE-2025-15201 | Low | 3.5 | 2025-12-29 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/contr… |
CVE-2025-15200 | Low | 2.4 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getCommandStatisticsByClient… |
CVE-2025-55064 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55063 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55062 | Medium | 4.8 | 2025-12-29 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-68868 | Medium | 6.5 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget a… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2025-68879 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in councilsoft Content Grid Slider content-grid-slider allow… |
CVE-2025-68878 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prasadkirpekar Advanced Custom CSS advanced-custom-css al… |
CVE-2025-68876 | High | 7.1 | 2025-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows… |
CVE-2025-68928 | Medium | 5.4 | 2025-12-29 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, whi… |
CVE-2025-65442 | Medium | 6.1 | 2025-12-29 | DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive… |
CVE-2025-57462 | Medium | 6.1 | 2025-12-29 | Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file. |
CVE-2025-15188 | Low | 2.4 | 2025-12-29 | A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/sea… |
CVE-2025-15175 | Low | 3.5 | 2025-12-29 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/co… |
CVE-2025-15174 | Low | 3.5 | 2025-12-29 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this vulnerability is the function doAppAuditList of the file src/main… |
CVE-2025-15173 | Low | 3.5 | 2025-12-29 | A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/control… |
CVE-2025-15172 | Low | 3.5 | 2025-12-29 | A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0. This impacts the function preview of the file src/main/java/com/sohu/cache/web/controller… |
CVE-2025-15171 | Low | 3.5 | 2025-12-29 | A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/Server… |
CVE-2025-15170 | Medium | 4.3 | 2025-12-29 | A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1. This affects an unknown part of the file /home.jsp?isError=true of the… |
CVE-2025-15149 | Low | 2.4 | 2025-12-28 | A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServ… |
CVE-2025-15146 | Low | 2.4 | 2025-12-28 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This impacts the function doUserList of the file src/main/java/com/sohu/cache/web/controller/Use… |
CVE-2025-15145 | Low | 2.4 | 2025-12-28 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. This affects the function doTotalList of the file src/main/java/com/sohu/cache/web… |
CVE-2025-15144 | Medium | 4.3 | 2025-12-28 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.ph… |
CVE-2025-15134 | Low | 3.5 | 2025-12-28 | A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the… |
CVE-2025-68927 | Medium | 6.1 | 2025-12-27 | Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. W… |
CVE-2025-61914 | High | 7.3 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the… |
CVE-2025-67349 | Medium | 6.1 | 2025-12-26 | A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the appli… |
CVE-2025-8075 | Medium | 5.4 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered that validat… |
CVE-2025-68946 | Medium | 5.4 | 2025-12-26 | In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. |
CVE-2025-68942 | Medium | 5.4 | 2025-12-26 | Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. |
CVE-2025-15095 | Low | 3.5 | 2025-12-26 | A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The… |
CVE-2025-15094 | Medium | 4.3 | 2025-12-26 | A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file s… |
CVE-2025-15093 | Medium | 4.3 | 2025-12-26 | A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file… |
CVE-2025-68936 | Medium | 6.4 | 2025-12-25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. |
CVE-2025-68935 | Medium | 6.4 | 2025-12-25 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. |
CVE-2025-2406 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-2405 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-2307 | High | 7.6 | 2025-12-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology I… |
CVE-2025-68917 | Medium | 6.4 | 2025-12-24 | ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer. |
CVE-2025-68915 | Medium | 5.5 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner. |
CVE-2019-25244 | Medium | 5.3 | 2025-12-24 | Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request… |
CVE-2019-25234 | Medium | 5.3 | 2025-12-24 | SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized act… |
CVE-2019-25233 | Medium | 5.3 | 2025-12-24 | AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions witho… |
CVE-2018-25131 | High | 7.2 | 2025-12-24 | Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload functionality. Attacke… |
CVE-2024-40317 | Medium | 6.1 | 2025-12-24 | A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via in… |
CVE-2024-35322 | Medium | 6.1 | 2025-12-24 | MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. |
CVE-2025-2154 | Medium | 5.4 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc… |
CVE-2025-68605 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2025-68599 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-e… |
CVE-2025-68598 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiveComposer Page Builder: Live Composer live-composer-pa… |
CVE-2025-68597 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings… |
CVE-2025-68574 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-v… |
CVE-2025-68566 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit… |
CVE-2025-68533 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This is… |
CVE-2025-68532 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor m… |
CVE-2025-68528 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shippin… |
CVE-2025-68527 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This is… |
CVE-2025-68525 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS… |
CVE-2025-68513 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows S… |
CVE-2025-68512 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook… |
CVE-2025-68497 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2025-67633 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brownbagmarketing Greenhouse Job Board greenhouse-job-boa… |
CVE-2025-67632 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design –… |
CVE-2025-67631 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecommerce Platforms Gift Hunt gift-hunt allows Stored XSS… |
CVE-2025-67630 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This i… |
CVE-2025-67629 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Sto… |
CVE-2025-67628 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Store… |
CVE-2025-67627 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TouchOfTech Draft Notify draft-notify allows Stored XSS.T… |
CVE-2023-32120 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bob Hostel allows DOM-Based XSS.This issue affects… |