CWE-79 · Cross-site Scripting (page 56)
Page 56 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9873 | Medium | 6.4 | 2025-12-13 | The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.5 due to insufficient input saniti… |
CVE-2025-9856 | Medium | 6.4 | 2025-12-13 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2025-9488 | Medium | 6.4 | 2025-12-13 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due… |
CVE-2025-8780 | Medium | 6.4 | 2025-12-13 | The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all… |
CVE-2025-8779 | Medium | 6.4 | 2025-12-13 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets i… |
CVE-2025-8687 | Medium | 6.4 | 2025-12-13 | The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up t… |
CVE-2025-8617 | Medium | 6.4 | 2025-12-13 | The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up… |
CVE-2025-8199 | Medium | 6.4 | 2025-12-13 | The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee widget in all versions up to, and incl… |
CVE-2025-8195 | Medium | 6.4 | 2025-12-13 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all v… |
CVE-2025-7960 | Medium | 6.4 | 2025-12-13 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image… |
CVE-2025-7058 | Medium | 6.4 | 2025-12-13 | The Kingcabs theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.1.9… |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |
CVE-2025-14378 | Medium | 4.4 | 2025-12-13 | The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to in… |
CVE-2025-14278 | Medium | 6.4 | 2025-12-13 | The HT Slider for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_title' parameter in all versions up to, and includ… |
CVE-2025-14056 | Medium | 4.4 | 2025-12-13 | The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versi… |
CVE-2025-13705 | Medium | 6.4 | 2025-12-13 | The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up… |
CVE-2025-12109 | Medium | 6.4 | 2025-12-13 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the script adder pr… |
CVE-2025-12077 | Medium | 6.1 | 2025-12-13 | The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9… |
CVE-2025-12076 | Medium | 6.1 | 2025-12-13 | The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and includi… |
CVE-2025-11376 | Medium | 6.4 | 2025-12-13 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_loop' shortcode in all versions up to, and… |
CVE-2025-67634 | Medium | 4.4 | 2025-12-12 | The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could c… |
CVE-2025-14580 | Low | 3.5 | 2025-12-12 | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/bi… |
CVE-2025-67734 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers… |
CVE-2024-58305 | High | 8.8 | 2025-12-12 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. At… |
CVE-2025-8082 | Medium | 6.3 | 2025-12-12 | Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a… |
CVE-2025-67342 | Medium | 4.6 | 2025-12-12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter… |
CVE-2025-67344 | Medium | 4.6 | 2025-12-12 | jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. |
CVE-2025-67341 | Medium | 4.6 | 2025-12-12 | jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Ad… |
CVE-2025-36746 | Medium | 5.4 | 2025-12-12 | SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may exec… |
CVE-2025-14030 | Medium | 6.4 | 2025-12-12 | The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22… |
CVE-2025-12965 | Medium | 6.4 | 2025-12-12 | The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion w… |
CVE-2025-13993 | Medium | 5.5 | 2025-12-12 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' par… |
CVE-2025-67730 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to ad… |
CVE-2025-4970 | Medium | 5.5 | 2025-12-12 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to i… |
CVE-2025-14049 | Medium | 6.1 | 2025-12-12 | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versio… |
CVE-2025-11876 | Medium | 6.4 | 2025-12-12 | The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versi… |
CVE-2025-12570 | High | 7.2 | 2025-12-12 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 d… |
CVE-2025-67724 | Medium | 5.4 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP header… |
CVE-2025-66492 | High | 8.2 | 2025-12-12 | Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 throug… |
CVE-2025-66284 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION… |
CVE-2025-65120 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZI… |
CVE-2025-57883 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZI… |
CVE-2025-54407 | Medium | 6.1 | 2025-12-12 | Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-53523 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-14467 | Medium | 4.4 | 2025-12-12 | The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin expl… |
CVE-2025-14393 | Medium | 6.4 | 2025-12-12 | The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and inclu… |
CVE-2025-14143 | Medium | 6.4 | 2025-12-12 | The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up t… |
CVE-2025-14138 | Medium | 6.1 | 2025-12-12 | The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14137 | Medium | 6.1 | 2025-12-12 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and in… |
CVE-2025-14132 | Medium | 6.1 | 2025-12-12 | The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14129 | Medium | 6.1 | 2025-12-12 | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14125 | Medium | 6.1 | 2025-12-12 | The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including… |
CVE-2025-14119 | Medium | 6.4 | 2025-12-12 | The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_vid… |
CVE-2025-14048 | Medium | 4.4 | 2025-12-12 | The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1… |
CVE-2025-14035 | Medium | 4.4 | 2025-12-12 | The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and incl… |
CVE-2025-14032 | Medium | 6.4 | 2025-12-12 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in al… |
CVE-2025-13989 | Medium | 6.4 | 2025-12-12 | The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including… |
CVE-2025-13988 | Medium | 6.1 | 2025-12-12 | The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1… |
CVE-2025-13975 | Medium | 4.4 | 2025-12-12 | The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settings in all versions up… |
CVE-2025-13971 | Medium | 4.4 | 2025-12-12 | The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0… |
CVE-2025-13969 | Medium | 6.4 | 2025-12-12 | The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all version… |
CVE-2025-13966 | Medium | 6.4 | 2025-12-12 | The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] short… |
CVE-2025-13963 | Medium | 6.4 | 2025-12-12 | The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, an… |
CVE-2025-13962 | Medium | 6.4 | 2025-12-12 | The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and includ… |
CVE-2025-13961 | Medium | 6.4 | 2025-12-12 | The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and includi… |
CVE-2025-13960 | Medium | 6.4 | 2025-12-12 | The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3… |
CVE-2025-13906 | Medium | 6.4 | 2025-12-12 | The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2… |
CVE-2025-13904 | Medium | 6.4 | 2025-12-12 | The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including… |
CVE-2025-13889 | Medium | 6.4 | 2025-12-12 | The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including… |
CVE-2025-13885 | Medium | 6.4 | 2025-12-12 | The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the `button` shortcode in all… |
CVE-2025-13884 | Medium | 6.4 | 2025-12-12 | The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the `bg-hide-email-address` shortcod… |
CVE-2025-13850 | Medium | 6.4 | 2025-12-12 | The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1… |
CVE-2025-13846 | Medium | 6.4 | 2025-12-12 | The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 du… |
CVE-2025-13843 | Medium | 6.4 | 2025-12-12 | The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' parameter of the 'spotlight' shortcode in… |
CVE-2025-13840 | Medium | 6.4 | 2025-12-12 | The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in al… |
CVE-2025-13747 | Medium | 6.4 | 2025-12-12 | The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and incl… |
CVE-2025-12834 | Medium | 6.1 | 2025-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in ver… |
CVE-2025-12830 | Medium | 6.4 | 2025-12-12 | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5… |
CVE-2025-12650 | Medium | 6.4 | 2025-12-12 | The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter in the postlist shortcode in all versi… |
CVE-2025-13839 | Medium | 6.4 | 2025-12-12 | The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and inc… |
CVE-2025-66452 | Medium | 6.1 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json(… |
CVE-2024-58304 | High | 7.5 | 2025-12-11 | SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inje… |
CVE-2024-58297 | Medium | 5.4 | 2025-12-11 | PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Att… |
CVE-2024-58296 | | 2025-12-11 | CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts… | |
CVE-2024-58292 | | 2025-12-11 | XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templ… | |
CVE-2024-58291 | | 2025-12-11 | Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fi… | |
CVE-2024-58289 | Medium | 5.4 | 2025-12-11 | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields… |
CVE-2025-55816 | Medium | 6.1 | 2025-12-11 | HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file. |
CVE-2025-14538 | Low | 3.5 | 2025-12-11 | A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CustomerManageHandler… |
CVE-2025-66918 | High | 8.8 | 2025-12-11 | edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. |
CVE-2025-14046 | Medium | 6.1 | 2025-12-11 | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs th… |
CVE-2025-67741 | Medium | 4.6 | 2025-12-11 | In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute |
CVE-2025-14519 | Low | 3.5 | 2025-12-11 | A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admi… |
CVE-2025-12029 | High | 8.0 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, und… |
CVE-2025-9436 | Medium | 6.4 | 2025-12-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to… |
CVE-2025-12716 | High | 8.7 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain c… |
CVE-2025-67648 | High | 7.1 | 2025-12-11 | Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php… |
CVE-2025-66472 | Medium | 6.1 | 2025-12-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc… |
CVE-2024-58285 | Medium | 5.4 | 2025-12-10 | Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can cr… |