CWE-79 · Cross-site Scripting (page 68)
Page 68 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11870 | Medium | 6.4 | 2025-10-22 | The Simple Business Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'simple_business_data' shortcode attributes in all versions up t… |
CVE-2025-11867 | Medium | 6.4 | 2025-10-22 | The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `book_author` post meta, rendered through the `[book_author]` s… |
CVE-2025-11866 | Medium | 6.4 | 2025-10-22 | The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes (`w`, `h`, `raw_css`, `look`, e… |
CVE-2025-11834 | Medium | 6.4 | 2025-10-22 | The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions… |
CVE-2025-11830 | Medium | 6.4 | 2025-10-22 | The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurant_summary shortcode in a… |
CVE-2025-11827 | Medium | 6.4 | 2025-10-22 | The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_widget' and 'after_widget' parameters of the oboxads-ad-wid… |
CVE-2025-11825 | Medium | 6.4 | 2025-10-22 | The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due… |
CVE-2025-11824 | Medium | 6.4 | 2025-10-22 | The Cinza Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cgrid_skin_content' post meta field in all versions up to, and includ… |
CVE-2025-11819 | Medium | 6.4 | 2025-10-22 | The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This… |
CVE-2025-11818 | Medium | 6.4 | 2025-10-22 | The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and incl… |
CVE-2025-11817 | Medium | 6.4 | 2025-10-22 | The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0… |
CVE-2025-11813 | Medium | 6.4 | 2025-10-22 | The Responsive iframe GoogleMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive_map' shortcode in all versions up to, and… |
CVE-2025-11811 | Medium | 6.4 | 2025-10-22 | The Simple Youtube Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embed_youtube' shortcode in all versions up to, and inc… |
CVE-2025-11810 | Medium | 6.4 | 2025-10-22 | The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and includ… |
CVE-2025-11809 | Medium | 6.4 | 2025-10-22 | The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including… |
CVE-2025-11807 | Medium | 6.4 | 2025-10-22 | The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. Th… |
CVE-2025-11804 | Medium | 6.4 | 2025-10-22 | The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versio… |
CVE-2025-10138 | Medium | 6.4 | 2025-10-22 | The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including… |
CVE-2025-12033 | Medium | 4.4 | 2025-10-22 | The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Sto… |
CVE-2025-10651 | Medium | 5.5 | 2025-10-22 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22… |
CVE-2025-62249 | Medium | 6.1 | 2025-10-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 thro… |
CVE-2025-61457 | Medium | 6.1 | 2025-10-21 | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. |
CVE-2025-61255 | Medium | 6.1 | 2025-10-21 | Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows… |
CVE-2025-60507 | High | 8.9 | 2025-10-21 | Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded J… |
CVE-2025-62598 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-62597 | Medium | 6.1 | 2025-10-21 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS)… |
CVE-2025-60506 | Medium | 5.4 | 2025-10-21 | Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account… |
CVE-2025-60280 | Medium | 6.1 | 2025-10-21 | Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This… |
CVE-2025-60934 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to… |
CVE-2025-60933 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers t… |
CVE-2025-60932 | Medium | 6.1 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers… |
CVE-2025-10612 | Medium | 6.1 | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows… |
CVE-2025-62702 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Ex… | |
CVE-2025-62701 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories a… | |
CVE-2025-62694 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Exte… | |
CVE-2025-62695 | | 2025-10-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Ex… | |
CVE-2025-12001 | Medium | 6.1 | 2025-10-20 | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-62657 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms exten… | |
CVE-2025-62656 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking… | |
CVE-2025-60781 | Medium | 6.1 | 2025-10-20 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter. |
CVE-2025-62528 | Medium | 5.4 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to… |
CVE-2025-62700 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerpl… | |
CVE-2025-62698 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuida… | |
CVE-2025-62693 | | 2025-10-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified… | |
CVE-2025-61456 | Medium | 6.1 | 2025-10-20 | A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index para… |
CVE-2025-61417 | High | 8.8 | 2025-10-20 | Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file… |
CVE-2025-61454 | Medium | 6.1 | 2025-10-20 | A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search pa… |
CVE-2025-8349 | | 2025-10-20 | Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by… | |
CVE-2025-11946 | Low | 3.5 | 2025-10-19 | A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the co… |
CVE-2025-11945 | Low | 3.5 | 2025-10-19 | A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such… |
CVE-2025-11926 | Medium | 4.4 | 2025-10-18 | The Related Posts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.12 due to i… |
CVE-2025-9562 | Medium | 6.4 | 2025-10-18 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to… |
CVE-2025-11270 | Medium | 6.4 | 2025-10-18 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleT… |
CVE-2025-10006 | Medium | 6.4 | 2025-10-18 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in all versions up to, a… |
CVE-2025-11937 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Ex… | |
CVE-2025-11857 | Medium | 6.4 | 2025-10-18 | The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in all versions up to… |
CVE-2025-62671 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extensi… | |
CVE-2025-62670 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams… | |
CVE-2025-62667 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperim… | |
CVE-2025-62664 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating E… | |
CVE-2025-62663 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard… | |
CVE-2025-62662 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearc… | |
CVE-2025-62665 | | 2025-10-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allo… | |
CVE-2020-36854 | Medium | 6.4 | 2025-10-18 | The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing au… |
CVE-2020-36853 | High | 7.2 | 2025-10-18 | The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due t… |
CVE-2025-62654 | | 2025-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extens… | |
CVE-2025-62653 | | 2025-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extensio… | |
CVE-2025-62652 | | 2025-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extens… | |
CVE-2025-62508 | Medium | 6.5 | 2025-10-17 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in… |
CVE-2025-56320 | Medium | 5.4 | 2025-10-17 | CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) in its chat box component. This allows a remote a… |
CVE-2025-34281 | Medium | 5.4 | 2025-10-17 | ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scr… |
CVE-2025-62430 | Medium | 5.4 | 2025-10-17 | ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and p… |
CVE-2025-62421 | Medium | 5.4 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improp… |
CVE-2025-58747 | Medium | 6.1 | 2025-10-17 | Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim co… |
CVE-2025-48087 | Medium | 6.5 | 2025-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allo… |
CVE-2025-62418 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (… |
CVE-2025-62414 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scr… |
CVE-2025-34253 | Medium | 5.4 | 2025-10-16 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' fie… |
CVE-2025-62413 | Medium | 6.1 | 2025-10-16 | MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling… |
CVE-2025-62412 | Low | 3.8 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts > Alert Rules page is not properly sanitized, and can… |
CVE-2025-62411 | Medium | 5.5 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Ale… |
CVE-2025-34512 | Medium | 6.1 | 2025-10-16 | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated… |
CVE-2025-11851 | Low | 3.5 | 2025-10-16 | A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such manipulation of the ar… |
CVE-2025-61539 | Medium | 6.1 | 2025-10-16 | Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php. |
CVE-2025-55072 | Medium | 5.4 | 2025-10-16 | Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser. |
CVE-2025-54859 | Medium | 4.8 | 2025-10-16 | Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser. |
CVE-2025-54760 | Medium | 5.4 | 2025-10-16 | Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser. |
CVE-2025-52583 | Medium | 6.1 | 2025-10-16 | Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser. |
CVE-2025-24833 | Medium | 5.4 | 2025-10-16 | Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser. |
CVE-2025-58115 | Medium | 6.1 | 2025-10-16 | ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user… |
CVE-2025-53858 | Medium | 5.4 | 2025-10-16 | ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is a… |
CVE-2025-0277 | Medium | 6.5 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into p… |
CVE-2025-0276 | Medium | 6.5 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker… |
CVE-2025-41021 | Medium | 5.4 | 2025-10-16 | Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST requ… |
CVE-2025-11814 | Medium | 6.4 | 2025-10-16 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient… |
CVE-2025-62380 | | 2025-10-15 | mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.31 contain an HTML injection v… | |
CVE-2025-20351 | Medium | 6.1 | 2025-10-15 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could… |
CVE-2025-61933 | Medium | 6.1 | 2025-10-15 | A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of th… |
CVE-2025-59269 | Medium | 6.1 | 2025-10-15 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript i… |
CVE-2025-10869 | Medium | 6.1 | 2025-10-15 | Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting… |