CWE-79 · Cross-site Scripting (page 67)
Page 67 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23724 | Medium | 4.3 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/atendido/cadas… |
CVE-2026-23722 | Critical | 9.1 | 2026-01-16 | WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, sp… |
CVE-2026-23645 | Medium | 6.1 | 2026-01-16 | SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiY… |
CVE-2021-47844 | Medium | 6.1 | 2026-01-16 | Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attacker… |
CVE-2021-47842 | High | 7.2 | 2026-01-16 | StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upl… |
CVE-2021-47841 | Medium | 6.1 | 2026-01-16 | SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute… |
CVE-2021-47840 | High | 7.2 | 2026-01-16 | Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can… |
CVE-2021-47839 | High | 7.2 | 2026-01-16 | Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can uploa… |
CVE-2021-47838 | High | 7.2 | 2026-01-16 | Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads in markdown files. Attackers can uploa… |
CVE-2021-47837 | High | 7.2 | 2026-01-16 | Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers c… |
CVE-2021-47836 | Medium | 6.1 | 2026-01-16 | Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. At… |
CVE-2021-47835 | High | 7.2 | 2026-01-16 | Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Att… |
CVE-2021-47834 | Medium | 6.4 | 2026-01-16 | Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into category titles. A… |
CVE-2025-31510 | High | 7.2 | 2026-01-16 | In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) v… |
CVE-2026-23528 | Medium | 6.1 | 2026-01-16 | Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together… |
CVE-2026-0949 | Medium | 6.5 | 2026-01-16 | PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject… |
CVE-2026-21624 | Medium | 5.4 | 2026-01-16 | Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla. |
CVE-2026-21623 | Medium | 5.4 | 2026-01-16 | Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla. |
CVE-2026-0695 | High | 8.7 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certai… |
CVE-2026-20894 | Medium | 4.8 | 2026-01-16 | Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures th… |
CVE-2026-0913 | Medium | 6.4 | 2026-01-16 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '… |
CVE-2025-14375 | Medium | 6.1 | 2026-01-16 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘class… |
CVE-2026-0916 | Medium | 6.4 | 2026-01-16 | The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'related_posts_by_tax' shortcode in all versio… |
CVE-2026-23769 | Medium | 6.1 | 2026-01-16 | lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset… |
CVE-2026-0858 | Medium | 6.1 | 2026-01-16 | Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attribut… |
CVE-2026-1011 | Medium | 6.1 | 2026-01-16 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Althou… |
CVE-2021-47808 | Medium | 5.4 | 2026-01-16 | Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicio… |
CVE-2021-47779 | Medium | 5.4 | 2026-01-16 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious… |
CVE-2026-1010 | High | 8.0 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submissio… |
CVE-2026-1009 | Critical | 9.0 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authentica… |
CVE-2026-1008 | High | 7.6 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows auth… |
CVE-2025-67823 | High | 8.2 | 2026-01-15 | A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthentica… |
CVE-2025-70891 | Medium | 6.1 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. The application doe… |
CVE-2025-70890 | Medium | 6.1 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code i… |
CVE-2025-67025 | Medium | 6.1 | 2026-01-15 | Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section |
CVE-2025-65368 | Medium | 6.1 | 2026-01-15 | SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output. |
CVE-2025-65349 | Medium | 5.4 | 2026-01-15 | A Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allow… |
CVE-2025-15265 | Medium | 6.1 | 2026-01-15 | An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe esca… |
CVE-2026-22867 | High | 8.7 | 2026-01-15 | LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in t… |
CVE-2026-20076 | Medium | 4.8 | 2026-01-15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a stored… |
CVE-2026-20075 | Medium | 4.8 | 2026-01-15 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-67078 | Medium | 6.1 | 2026-01-15 | Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the f… |
CVE-2021-47843 | Medium | 5.4 | 2026-01-15 | Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers c… |
CVE-2021-47769 | Medium | 4.8 | 2026-01-15 | Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers… |
CVE-2021-47768 | Medium | 6.1 | 2026-01-15 | ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML… |
CVE-2026-22919 | Low | 3.8 | 2026-01-15 | An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to th… |
CVE-2026-22913 | Medium | 4.3 | 2026-01-15 | Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data. |
CVE-2025-14448 | Medium | 5.4 | 2026-01-15 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile f… |
CVE-2026-0601 | | 2026-01-14 | A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's… | |
CVE-2026-23497 | Medium | 5.4 | 2026-01-14 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerabili… |
CVE-2025-71166 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S… |
CVE-2025-71165 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S… |
CVE-2025-71164 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (su… |
CVE-2025-14557 | Medium | 4.8 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored… |
CVE-2025-14556 | Medium | 5.4 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This… |
CVE-2025-11224 | High | 7.7 | 2026-01-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allo… |
CVE-2025-63644 | Medium | 5.4 | 2026-01-14 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field. |
CVE-2026-22787 | Medium | 6.1 | 2026-01-14 | html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulne… |
CVE-2025-67834 | Medium | 5.4 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter. |
CVE-2025-67833 | Medium | 6.1 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter. |
CVE-2025-37185 | Medium | 5.5 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2026-0813 | Medium | 4.4 | 2026-01-14 | The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all… |
CVE-2026-0812 | Medium | 4.4 | 2026-01-14 | The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'linkedin_sc_api_key', and 'linkedin_sc_se… |
CVE-2026-0741 | Medium | 4.4 | 2026-01-14 | The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and inclu… |
CVE-2026-0739 | Medium | 4.4 | 2026-01-14 | The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 d… |
CVE-2026-0734 | Medium | 4.4 | 2026-01-14 | The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including… |
CVE-2026-0694 | Medium | 6.4 | 2026-01-14 | The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0… |
CVE-2026-0680 | Medium | 4.4 | 2026-01-14 | The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 d… |
CVE-2026-0594 | Medium | 6.1 | 2026-01-14 | The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1… |
CVE-2025-15486 | Medium | 4.4 | 2026-01-14 | The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plu… |
CVE-2025-15378 | High | 7.2 | 2026-01-14 | The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all v… |
CVE-2025-15283 | High | 7.2 | 2026-01-14 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters… |
CVE-2025-15266 | High | 7.2 | 2026-01-14 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat m… |
CVE-2025-15021 | Medium | 4.4 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 d… |
CVE-2025-14725 | Medium | 4.4 | 2026-01-14 | The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to… |
CVE-2025-14379 | Medium | 4.4 | 2026-01-14 | The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitiza… |
CVE-2025-13627 | Medium | 4.4 | 2026-01-14 | The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in all versions up to, and including, 0.1 du… |
CVE-2025-12178 | Medium | 6.4 | 2026-01-14 | The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and includi… |
CVE-2023-54341 | Medium | 6.1 | 2026-01-13 | Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file… |
CVE-2023-54332 | Medium | 6.1 | 2026-01-13 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id par… |
CVE-2023-53985 | Medium | 6.1 | 2026-01-13 | Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through u… |
CVE-2022-50937 | Medium | 6.1 | 2026-01-13 | Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malici… |
CVE-2022-50908 | High | 7.2 | 2026-01-13 | Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can s… |
CVE-2022-50906 | Medium | 4.8 | 2026-01-13 | e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media man… |
CVE-2022-50905 | Critical | 9.8 | 2026-01-13 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs… |
CVE-2022-50896 | Medium | 6.1 | 2026-01-13 | Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Atta… |
CVE-2022-50891 | Medium | 5.0 | 2026-01-13 | Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP… |
CVE-2021-47750 | Medium | 6.1 | 2026-01-13 | YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the sign… |
CVE-2020-36919 | Medium | 6.1 | 2026-01-13 | WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts throu… |
CVE-2025-68658 | Medium | 4.3 | 2026-01-13 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 ha… |
CVE-2025-15056 | Medium | 6.1 | 2026-01-13 | A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3. |
CVE-2026-20959 | Medium | 4.6 | 2026-01-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2025-9427 | | 2026-01-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scrip… | |
CVE-2026-0514 | Medium | 6.1 | 2026-01-13 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting use… |
CVE-2026-0499 | Medium | 6.1 | 2026-01-13 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server re… |
CVE-2026-22813 | Medium | 6.1 | 2026-01-12 | OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with… |
CVE-2026-22804 | High | 8.0 | 2026-01-12 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting… |
CVE-2026-22033 | Medium | 5.4 | 2026-01-12 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in t… |
CVE-2025-66939 | Medium | 5.4 | 2026-01-12 | Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file |
CVE-2025-41003 | | 2026-01-12 | Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.ph… |