CWE-79 · Cross-site Scripting (page 69)
Page 69 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69082 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects… |
CVE-2025-32300 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XS… |
CVE-2025-15000 | Medium | 4.4 | 2026-01-07 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to… |
CVE-2025-14891 | Medium | 6.4 | 2026-01-07 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, a… |
CVE-2025-14888 | Medium | 4.4 | 2026-01-07 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and includin… |
CVE-2025-14887 | Medium | 4.4 | 2026-01-07 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all ve… |
CVE-2025-14875 | Medium | 6.1 | 2026-01-07 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up… |
CVE-2025-14796 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4. This is du… |
CVE-2025-14626 | Medium | 6.4 | 2026-01-07 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortc… |
CVE-2025-14453 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and inclu… |
CVE-2025-14147 | Medium | 6.4 | 2026-01-07 | The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions… |
CVE-2025-14145 | Medium | 6.4 | 2026-01-07 | The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh… |
CVE-2025-14144 | Medium | 6.4 | 2026-01-07 | The Mstoic Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'start' parameter of the ms_youtube_embeds shortcode in all ver… |
CVE-2025-14131 | Medium | 6.1 | 2026-01-07 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14130 | Medium | 6.1 | 2026-01-07 | The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14128 | Medium | 6.1 | 2026-01-07 | The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14127 | Medium | 6.1 | 2026-01-07 | The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14122 | Medium | 6.4 | 2026-01-07 | The AD Sliding FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliding_faq' shortcode in all versions up to, and including, 2.4… |
CVE-2025-14121 | Medium | 6.4 | 2026-01-07 | The EDD Download Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'edd_download_info_link' shortcode in all versions up to, and i… |
CVE-2025-14118 | Medium | 6.1 | 2026-01-07 | The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 d… |
CVE-2025-14114 | Medium | 6.4 | 2026-01-07 | The 1180px Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and includin… |
CVE-2025-14113 | Medium | 6.4 | 2026-01-07 | The Viitor Button Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' shortcode attribute in all versions up to, and in… |
CVE-2025-14112 | Medium | 6.4 | 2026-01-07 | The Snillrik Restaurant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'menu_style' shortcode attribute in all versions up to, and i… |
CVE-2025-14110 | Medium | 6.4 | 2026-01-07 | The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, an… |
CVE-2025-14109 | Medium | 6.4 | 2026-01-07 | The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including… |
CVE-2025-14057 | Medium | 4.4 | 2026-01-07 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 17.0.39 due… |
CVE-2025-14053 | Medium | 6.4 | 2026-01-07 | The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to in… |
CVE-2025-14028 | Medium | 4.4 | 2026-01-07 | The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due t… |
CVE-2025-13974 | Medium | 4.4 | 2026-01-07 | The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and in… |
CVE-2025-13887 | Medium | 6.4 | 2026-01-07 | The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_bot… |
CVE-2025-13849 | Medium | 6.4 | 2026-01-07 | The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due… |
CVE-2025-13848 | Medium | 6.4 | 2026-01-07 | The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to, and including, 0.9… |
CVE-2025-13847 | Medium | 6.4 | 2026-01-07 | The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to ins… |
CVE-2025-13841 | Medium | 6.4 | 2026-01-07 | The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-downloa… |
CVE-2025-13667 | Medium | 6.4 | 2026-01-07 | The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including… |
CVE-2025-13531 | Medium | 6.4 | 2026-01-07 | The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and in… |
CVE-2025-13497 | Medium | 6.4 | 2026-01-07 | The Recras WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'recrasname' shortcode attribute in all versions up to, and incl… |
CVE-2025-13418 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and includ… |
CVE-2025-13369 | Medium | 6.1 | 2026-01-07 | The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to'… |
CVE-2025-31642 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue aff… |
CVE-2025-30631 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon… |
CVE-2025-13744 | Medium | 5.4 | 2026-01-06 | An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML t… |
CVE-2025-69362 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue aff… |
CVE-2025-69360 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-e… |
CVE-2025-69357 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-… |
CVE-2025-69350 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.Thi… |
CVE-2025-69335 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS… |
CVE-2025-69334 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2025-69085 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue… |
CVE-2025-69084 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Re… |
CVE-2025-63083 | Medium | 6.1 | 2026-01-06 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. |
CVE-2025-63082 | Medium | 6.1 | 2026-01-06 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. |
CVE-2024-31088 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSen… |
CVE-2024-30547 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider al… |
CVE-2025-14552 | Medium | 6.4 | 2026-01-06 | The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including… |
CVE-2025-12067 | Medium | 6.4 | 2026-01-06 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and… |
CVE-2025-4776 | Medium | 6.4 | 2026-01-06 | The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 d… |
CVE-2025-14120 | Medium | 6.4 | 2026-01-06 | The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due t… |
CVE-2025-13746 | Medium | 6.4 | 2026-01-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and… |
CVE-2025-66648 | High | 7.2 | 2026-01-05 | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user… |
CVE-2025-65110 | High | 8.1 | 2026-01-05 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, a… |
CVE-2025-59158 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 a… |
CVE-2025-55204 | High | 8.8 | 2026-01-05 | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attack… |
CVE-2025-67316 | Medium | 5.4 | 2026-01-05 | An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser… |
CVE-2025-59467 | High | 7.5 | 2026-01-05 | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator… |
CVE-2025-39497 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka… |
CVE-2024-53735 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager al… |
CVE-2024-30461 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-12513 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration for… |
CVE-2025-12511 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configura… |
CVE-2024-23511 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builde… |
CVE-2023-51513 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS… |
CVE-2023-49186 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This iss… |
CVE-2026-0588 | Low | 3.5 | 2026-01-05 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the… |
CVE-2026-0587 | Low | 3.5 | 2026-01-05 | A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover… |
CVE-2026-0586 | Medium | 4.3 | 2026-01-05 | A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file handgunner-adminis… |
CVE-2025-13056 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu… |
CVE-2026-0580 | Low | 3.5 | 2026-01-05 | A vulnerability was found in SourceCodester API Key Manager App 1.0. Affected by this vulnerability is an unknown functionality of the component Import Key Han… |
CVE-2025-15022 | | 2026-01-05 | Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from use… | |
CVE-2025-15454 | Low | 3.1 | 2026-01-05 | A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender… |
CVE-2025-15452 | Low | 2.4 | 2026-01-05 | A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component… |
CVE-2025-15451 | Low | 2.4 | 2026-01-05 | A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.d… |
CVE-2025-5591 | Medium | 5.4 | 2026-01-05 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and per… |
CVE-2025-14830 | Medium | 4.9 | 2026-01-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scri… |
CVE-2026-21483 | Medium | 5.4 | 2026-01-02 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions… |
CVE-2026-21451 | High | 8.4 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CM… |
CVE-2026-21432 | Medium | 5.4 | 2026-01-02 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including ta… |
CVE-2026-21431 | Medium | 5.4 | 2026-01-02 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while… |
CVE-2026-21430 | Critical | 9.3 | 2026-01-02 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can… |
CVE-2025-62857 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mech… |
CVE-2025-15437 | Low | 3.5 | 2026-01-02 | A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of… |
CVE-2025-15416 | Low | 2.4 | 2026-01-01 | A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Hand… |
CVE-2025-67711 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67710 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67709 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67708 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67705 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67704 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |
CVE-2025-67703 | Medium | 6.1 | 2025-12-31 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenti… |