CWE-79 · Cross-site Scripting (page 6)
Page 6 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16091 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16090 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-15950 | Medium | 6.4 | 2026-08-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15662 | Medium | 6.4 | 2026-08-01 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' paramete… |
CVE-2026-15649 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15645 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions… |
CVE-2026-15644 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all version… |
CVE-2026-15052 | High | 7.2 | 2026-08-01 | The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Value… |
CVE-2026-13458 | Medium | 6.4 | 2026-08-01 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and in… |
CVE-2026-15262 | Medium | 5.4 | 2026-08-01 | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin lis… |
CVE-2026-15234 | Medium | 5.4 | 2026-08-01 | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering… |
CVE-2026-14292 | Medium | 5.4 | 2026-08-01 | The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowin… |
CVE-2026-13725 | High | 7.1 | 2026-08-01 | The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions… |
CVE-2026-12696 | Medium | 5.4 | 2026-08-01 | The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-13362 | Medium | 6.4 | 2026-08-01 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, a… |
CVE-2026-52232 | Medium | 6.1 | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arb… |
CVE-2026-62324 | Medium | 5.4 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl… |
CVE-2026-18481 | High | 7.3 | 2026-07-31 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens… |
CVE-2026-34495 | Medium | 5.4 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. … |
CVE-2026-59232 | | 2026-07-31 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to… | |
CVE-2026-46594 | | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially craft… | |
CVE-2026-14922 | Medium | 6.1 | 2026-07-31 | WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encod… |
CVE-2026-14921 | Medium | 6.1 | 2026-07-31 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(), |
CVE-2026-14845 | Medium | 6.1 | 2026-07-31 | The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outp… |
CVE-2026-14833 | Medium | 6.8 | 2026-07-31 | The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox captio… |
CVE-2026-13609 | High | 8.8 | 2026-07-31 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML… |
CVE-2026-13393 | Low | 3.5 | 2026-07-31 | The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outpu… |
CVE-2026-56672 | High | 8.2 | 2026-07-31 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-d… |
CVE-2026-56670 | High | 8.2 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline be… |
CVE-2026-66421 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the adm… |
CVE-2026-66418 | Critical | 9.3 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script… |
CVE-2026-61526 | Medium | 6.1 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the er… |
CVE-2025-65342 | Medium | 6.1 | 2026-07-30 | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. |
CVE-2025-65341 | Medium | 6.1 | 2026-07-30 | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. |
CVE-2025-51684 | Medium | 6.1 | 2026-07-30 | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before… |
CVE-2025-0152 | Medium | 6.1 | 2026-07-30 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting… |
CVE-2026-11707 | Critical | 9.3 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administra… |
CVE-2026-11383 | Medium | 5.4 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. |
CVE-2025-36431 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-36298 | Medium | 5.4 | 2026-07-30 | IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling Fil… |
CVE-2026-18361 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. |
CVE-2026-18360 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. |
CVE-2026-16969 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. |
CVE-2026-59328 | Medium | 4.2 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untru… |
CVE-2026-14592 | Medium | 6.1 | 2026-07-30 | The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and… |
CVE-2026-14318 | Medium | 6.8 | 2026-07-30 | The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-14207 | Medium | 6.1 | 2026-07-30 | The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing us… |
CVE-2026-13344 | Medium | 4.8 | 2026-07-30 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it… |
CVE-2026-13330 | Medium | 6.1 | 2026-07-30 | The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types… |
CVE-2026-11881 | Medium | 6.1 | 2026-07-30 | The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline… |
CVE-2026-17962 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafte… |
CVE-2026-17903 | Medium | 5.4 | 2026-07-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTM… |
CVE-2026-17878 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-17853 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject s… |
CVE-2026-17845 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-17827 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-17818 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-17797 | Medium | 6.1 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-17739 | Medium | 4.2 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17734 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cra… |
CVE-2026-17728 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a c… |
CVE-2025-65337 | Medium | 6.1 | 2026-07-29 | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. |
CVE-2026-3093 | Medium | 4.7 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-66490 | Medium | 6.1 | 2026-07-29 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 |
CVE-2026-65946 | Medium | 6.1 | 2026-07-29 | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 |
CVE-2026-8791 | Medium | 6.4 | 2026-07-29 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
CVE-2026-7436 | Medium | 6.4 | 2026-07-29 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-16655 | High | 7.2 | 2026-07-29 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-16597 | High | 7.2 | 2026-07-29 | The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields i… |
CVE-2026-13425 | High | 7.2 | 2026-07-29 | The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6… |
CVE-2026-18197 | Medium | 6.1 | 2026-07-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This iss… |
CVE-2026-14234 | High | 7.1 | 2026-07-29 | The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick… |
CVE-2026-13605 | Medium | 6.8 | 2026-07-29 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM… |
CVE-2026-17162 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attri… |
CVE-2026-17161 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block At… |
CVE-2026-15735 | Medium | 6.4 | 2026-07-29 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and i… |
CVE-2026-12939 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thu… |
CVE-2026-12938 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versio… |
CVE-2026-14515 | Medium | 6.1 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. |
CVE-2026-48060 | High | 8.1 | 2026-07-28 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction w… |
CVE-2026-18084 | Medium | 6.1 | 2026-07-28 | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (X… |
CVE-2026-7775 | Medium | 5.5 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2… |
CVE-2026-67174 | | 2026-07-28 | Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement… | |
CVE-2026-66921 | | 2026-07-28 | Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name a… | |
CVE-2026-66919 | | 2026-07-28 | Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were inter… | |
CVE-2026-66918 | | 2026-07-28 | Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When ren… | |
CVE-2026-65882 | Medium | 6.1 | 2026-07-28 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS… |
CVE-2026-15393 | Medium | 6.4 | 2026-07-28 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15016 | Medium | 6.4 | 2026-07-28 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via R… |
CVE-2026-13440 | High | 7.2 | 2026-07-28 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross… |
CVE-2026-11598 | Medium | 5.0 | 2026-07-28 | The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 du… |
CVE-2026-8167 | Medium | 6.1 | 2026-07-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XS… |
CVE-2026-44387 | Medium | 5.2 | 2026-07-28 | ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an a… |
CVE-2026-15730 | Medium | 6.4 | 2026-07-28 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-14870 | High | 7.1 | 2026-07-28 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it… |
CVE-2026-14819 | Low | 3.5 | 2026-07-28 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowin… |
CVE-2026-17528 | Medium | 6.1 | 2026-07-28 | Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious pay… |