CWE-79 · Cross-site Scripting (page 62)
Page 62 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12079 | Medium | 6.1 | 2025-11-18 | The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 du… |
CVE-2025-8609 | Medium | 6.4 | 2025-11-18 | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions… |
CVE-2025-8605 | Medium | 6.4 | 2025-11-18 | The Gutenify – Visual Site Builder Blocks & Site Templates. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes… |
CVE-2025-26391 | Medium | 5.4 | 2025-11-18 | SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. Th… |
CVE-2025-12823 | Medium | 6.4 | 2025-11-18 | The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to… |
CVE-2025-12078 | Medium | 6.1 | 2025-11-18 | The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and includin… |
CVE-2025-11868 | Medium | 6.4 | 2025-11-18 | The everviz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `everviz` shortcode attributes in versions up to, and including, 1.1. Thi… |
CVE-2024-44661 | Medium | 5.4 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to Cross Site Scripting (XSS) via the quantity parameter in my-cart.php. |
CVE-2024-46335 | Medium | 4.6 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. |
CVE-2024-44655 | Medium | 6.1 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. |
CVE-2025-64758 | Medium | 4.8 | 2025-11-17 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to… |
CVE-2025-55059 | Medium | 4.8 | 2025-11-17 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-55056 | Medium | 4.8 | 2025-11-17 | Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2024-46336 | Medium | 6.1 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. |
CVE-2024-46334 | Medium | 6.1 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. |
CVE-2024-44647 | Medium | 6.1 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. |
CVE-2025-64046 | Medium | 6.1 | 2025-11-17 | OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php. |
CVE-2025-63708 | Medium | 6.1 | 2025-11-17 | Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary Jav… |
CVE-2025-40834 | Medium | 5.7 | 2025-11-17 | A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could al… |
CVE-2025-13245 | Low | 3.5 | 2025-11-16 | A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such… |
CVE-2025-13244 | Medium | 4.3 | 2025-11-16 | A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /register.php. This man… |
CVE-2025-13232 | Low | 3.5 | 2025-11-16 | A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation cause… |
CVE-2025-13202 | Low | 3.5 | 2025-11-15 | A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /add_to_cart. Performing manipul… |
CVE-2025-13186 | Low | 2.4 | 2025-11-14 | A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file… |
CVE-2025-13182 | Low | 3.5 | 2025-11-14 | A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of… |
CVE-2025-13181 | Low | 3.5 | 2025-11-14 | A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation… |
CVE-2025-13180 | Low | 3.5 | 2025-11-14 | A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of t… |
CVE-2025-13178 | Low | 3.5 | 2025-11-14 | A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Pro… |
CVE-2025-63830 | Medium | 6.1 | 2025-11-14 | CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content. |
CVE-2025-63725 | Medium | 6.1 | 2025-11-14 | Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php. |
CVE-2024-44635 | Medium | 6.1 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php. |
CVE-2024-42749 | Medium | 6.1 | 2025-11-14 | Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script. |
CVE-2025-10018 | Medium | 4.8 | 2025-11-14 | QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML… |
CVE-2025-13097 | Medium | 5.4 | 2025-11-14 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2025-12904 | High | 7.2 | 2025-11-14 | The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and i… |
CVE-2025-64747 | Medium | 5.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2025-64745 | Low | 2.7 | 2025-11-13 | Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's develop… |
CVE-2025-64744 | Low | 3.5 | 2025-11-13 | OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name… |
CVE-2025-59840 | High | 8.1 | 2025-11-13 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, appl… |
CVE-2025-20353 | Medium | 6.1 | 2025-11-13 | A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scriptin… |
CVE-2025-62482 | Medium | 4.3 | 2025-11-13 | Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access. |
CVE-2025-40681 | | 2025-11-13 | Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the vic… | |
CVE-2025-64383 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue aff… |
CVE-2025-64381 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This… |
CVE-2025-64380 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allo… |
CVE-2025-64292 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PascalBajorat Analytics Germanized for Google Analytics g… |
CVE-2025-64275 | Medium | 6.5 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored X… |
CVE-2025-64264 | Medium | 5.9 | 2025-11-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-fo… |
CVE-2025-8397 | Medium | 6.4 | 2025-11-13 | The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, an… |
CVE-2025-11769 | Medium | 6.4 | 2025-11-13 | The WordPress Content Flipper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' shortcode attribute of the 'flipper_front' sh… |
CVE-2025-10295 | Medium | 6.4 | 2025-11-13 | The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting the profile media uploader in all version… |
CVE-2025-64716 | | 2025-11-13 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when… | |
CVE-2025-64711 | Low | 3.9 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whos… |
CVE-2025-64710 | | 2025-11-13 | Bitplatform Boilerplate is a Visual studio and .NET project template. Versions prior to 9.11.3 are affected by a cross-site scripting (XSS) vulnerability in th… | |
CVE-2025-63645 | Medium | 5.4 | 2025-11-12 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message c… |
CVE-2025-13058 | Low | 3.5 | 2025-11-12 | A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The mani… |
CVE-2025-60646 | Medium | 6.1 | 2025-11-12 | A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a… |
CVE-2025-63419 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filena… |
CVE-2025-59491 | Medium | 6.1 | 2025-11-12 | Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields. |
CVE-2025-52331 | Medium | 6.1 | 2025-11-12 | Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the… |
CVE-2025-11994 | High | 7.2 | 2025-11-12 | The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1… |
CVE-2025-61623 | Medium | 6.5 | 2025-11-12 | Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 2… |
CVE-2025-11962 | High | 7.3 | 2025-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital C… |
CVE-2025-12872 | Medium | 5.4 | 2025-11-12 | The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing ma… |
CVE-2025-12869 | Medium | 4.8 | 2025-11-12 | The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent Ja… |
CVE-2025-12018 | Medium | 4.4 | 2025-11-12 | The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to… |
CVE-2025-62211 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62210 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-9227 | Medium | 6.5 | 2025-11-11 | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. |
CVE-2025-12101 | | 2025-11-11 | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy… | |
CVE-2025-41106 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41105 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41104 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41103 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41102 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41101 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-11960 | Medium | 6.1 | 2025-11-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET… |
CVE-2025-7633 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. |
CVE-2025-7632 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. |
CVE-2025-7430 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. |
CVE-2025-7429 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. |
CVE-2025-12880 | Medium | 5.4 | 2025-11-11 | The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2025-12754 | Medium | 6.4 | 2025-11-11 | The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and… |
CVE-2025-12711 | Medium | 6.4 | 2025-11-11 | The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and in… |
CVE-2025-12672 | Medium | 6.4 | 2025-11-11 | The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions… |
CVE-2025-12671 | Medium | 6.4 | 2025-11-11 | The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, a… |
CVE-2025-12668 | Medium | 6.4 | 2025-11-11 | The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all… |
CVE-2025-12667 | Medium | 6.4 | 2025-11-11 | The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up t… |
CVE-2025-12663 | Medium | 6.4 | 2025-11-11 | The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions… |
CVE-2025-12662 | Medium | 6.4 | 2025-11-11 | The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to… |
CVE-2025-12658 | Medium | 6.4 | 2025-11-11 | The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortco… |
CVE-2025-12652 | Medium | 6.4 | 2025-11-11 | The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all… |
CVE-2025-12651 | Medium | 6.4 | 2025-11-11 | The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the li… |
CVE-2025-12644 | Medium | 6.4 | 2025-11-11 | The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode i… |
CVE-2025-12632 | Medium | 5.5 | 2025-11-11 | The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insuffi… |
CVE-2025-12631 | Medium | 4.4 | 2025-11-11 | The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 d… |
CVE-2025-12538 | Medium | 4.4 | 2025-11-11 | The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insuf… |
CVE-2025-12021 | Medium | 6.1 | 2025-11-11 | The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0… |
CVE-2025-12020 | Medium | 4.9 | 2025-11-11 | The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin… |
CVE-2025-12019 | Medium | 4.4 | 2025-11-11 | The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insuff… |