CWE-79 · Cross-site Scripting (page 54)
Page 54 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66444 | High | 8.2 | 2025-12-24 | Cross-site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops C… |
CVE-2025-15052 | Low | 3.5 | 2025-12-24 | A vulnerability was detected in code-projects Student Information System 1.0. This vulnerability affects unknown code of the file /profile.php. Performing mani… |
CVE-2025-68669 | Critical | 9.6 | 2025-12-23 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists… |
CVE-2025-14499 | High | 8.8 | 2025-12-23 | IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected install… |
CVE-2021-47738 | Medium | 5.4 | 2025-12-23 | CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attack… |
CVE-2021-47737 | Medium | 5.4 | 2025-12-23 | CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft PO… |
CVE-2021-47733 | Medium | 6.1 | 2025-12-23 | CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inj… |
CVE-2021-47732 | Medium | 6.1 | 2025-12-23 | CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript… |
CVE-2021-47716 | Medium | 5.4 | 2025-12-23 | Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input p… |
CVE-2025-66845 | Medium | 6.1 | 2025-12-23 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter direc… |
CVE-2025-13183 | High | 7.3 | 2025-12-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS. Th… |
CVE-2025-68559 | Medium | 6.5 | 2025-12-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-… |
CVE-2025-68548 | Medium | 6.5 | 2025-12-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-p… |
CVE-2025-14635 | Medium | 6.4 | 2025-12-23 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, a… |
CVE-2025-14000 | Medium | 6.4 | 2025-12-23 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shor… |
CVE-2025-14548 | Medium | 6.4 | 2025-12-23 | The Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_desc' parameter in all versions up to, and including, 1.3.16 due… |
CVE-2025-68614 | Medium | 4.3 | 2025-12-23 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site s… |
CVE-2023-53978 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject mal… |
CVE-2023-53977 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malic… |
CVE-2023-53976 | Medium | 5.4 | 2025-12-22 | myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject ma… |
CVE-2025-67291 | Medium | 6.1 | 2025-12-22 | A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via inject… |
CVE-2025-67290 | Medium | 6.1 | 2025-12-22 | A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2025-65837 | Medium | 5.4 | 2025-12-22 | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. |
CVE-2025-65790 | Medium | 6.1 | 2025-12-22 | A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not san… |
CVE-2024-25812 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter. |
CVE-2024-35321 | Medium | 4.3 | 2025-12-22 | MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. |
CVE-2024-25814 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter. |
CVE-2025-67289 | Critical | 9.6 | 2025-12-22 | An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-65270 | Medium | 6.1 | 2025-12-22 | Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in… |
CVE-2025-67443 | Medium | 6.1 | 2025-12-22 | Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in l… |
CVE-2025-8460 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Ope… |
CVE-2025-54890 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration… |
CVE-2025-62094 | Medium | 6.5 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidthemes Void Elementor WHMCS Elements For Elementor Pa… |
CVE-2025-62926 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyDevs TempTool [Show Current Template Info] current-… |
CVE-2025-62901 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten WP Microdata wp-microdata allows Stored XSS.Thi… |
CVE-2025-14855 | High | 7.2 | 2025-12-21 | The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due t… |
CVE-2025-9343 | High | 7.2 | 2025-12-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions u… |
CVE-2025-14991 | Low | 2.4 | 2025-12-21 | A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin… |
CVE-2025-13693 | Medium | 6.4 | 2025-12-21 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up… |
CVE-2025-13220 | Medium | 6.4 | 2025-12-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-12398 | Medium | 6.1 | 2025-12-21 | The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, an… |
CVE-2025-14054 | Medium | 4.4 | 2025-12-21 | The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and… |
CVE-2025-13838 | Medium | 6.4 | 2025-12-21 | The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all vers… |
CVE-2025-11496 | Medium | 6.1 | 2025-12-21 | The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter… |
CVE-2025-14298 | Medium | 5.4 | 2025-12-20 | The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in… |
CVE-2025-14721 | Medium | 5.5 | 2025-12-20 | The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rsSlider shortcode in all versions up to, an… |
CVE-2025-13624 | Medium | 6.1 | 2025-12-20 | The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up… |
CVE-2025-12581 | Medium | 6.1 | 2025-12-20 | The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insuffi… |
CVE-2023-53953 | Medium | 5.4 | 2025-12-19 | WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating web pages. A… |
CVE-2025-67712 | Medium | 4.7 | 2025-12-19 | There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to poten… |
CVE-2025-14962 | Medium | 4.3 | 2025-12-19 | A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation… |
CVE-2025-68457 | Medium | 6.1 | 2025-12-19 | Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embeddi… |
CVE-2025-66580 | Critical | 9.6 | 2025-12-19 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-14151 | High | 7.2 | 2025-12-19 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in… |
CVE-2025-11747 | Medium | 6.4 | 2025-12-19 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and incl… |
CVE-2025-66522 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application… |
CVE-2025-66521 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as t… |
CVE-2025-66520 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files… |
CVE-2025-66519 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into t… |
CVE-2025-66502 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the templ… |
CVE-2025-66501 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payloa… |
CVE-2025-66500 | Medium | 6.3 | 2025-12-19 | A stored cross-site scripting (XSS) vulnerability exists in webplugins.foxit.com. A postMessage handler fails to validate the message origin and directly assig… |
CVE-2025-14449 | Medium | 6.4 | 2025-12-19 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and… |
CVE-2025-64675 | High | 8.3 | 2025-12-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing ove… |
CVE-2025-68387 | Medium | 6.1 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in con… |
CVE-2025-68385 | High | 7.2 | 2025-12-18 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in conte… |
CVE-2025-64677 | High | 8.2 | 2025-12-18 | Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform… |
CVE-2025-63949 | Medium | 6.1 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web scr… |
CVE-2025-63947 | Medium | 5.4 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web scri… |
CVE-2025-67163 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2024-58323 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows mali… |
CVE-2024-58322 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead… |
CVE-2024-58321 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers… |
CVE-2024-58319 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration d… |
CVE-2024-58318 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and f… |
CVE-2023-53939 | Medium | 5.4 | 2025-12-18 | TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder nam… |
CVE-2023-53938 | Medium | 5.4 | 2025-12-18 | RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input paramet… |
CVE-2023-53936 | Medium | 4.8 | 2025-12-18 | Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titl… |
CVE-2023-53738 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can… |
CVE-2023-53737 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. At… |
CVE-2023-53736 | Medium | 5.4 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Att… |
CVE-2022-50685 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachment… |
CVE-2022-50684 | Medium | 6.1 | 2025-12-18 | An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Un… |
CVE-2022-50683 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows… |
CVE-2022-50681 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich te… |
CVE-2022-50680 | Medium | 4.8 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attacke… |
CVE-2020-36891 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions… |
CVE-2020-36889 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted o… |
CVE-2025-64355 | Medium | 6.5 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-9787 | Medium | 6.1 | 2025-12-18 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. |
CVE-2025-40893 | Medium | 6.1 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated att… |
CVE-2025-40892 | High | 8.9 | 2025-12-18 | A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40891 | Medium | 4.7 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An una… |
CVE-2025-13730 | Medium | 6.4 | 2025-12-18 | The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcod… |
CVE-2025-6324 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based X… |
CVE-2025-66119 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects… |
CVE-2025-66118 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected X… |
CVE-2025-66102 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS… |
CVE-2025-64376 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.T… |
CVE-2025-64372 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This is… |