CWE-79 · Cross-site Scripting (page 7)
Page 7 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92106 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and s… | |
CVE-2026-6088 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6087 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6086 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6085 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6084 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-6083 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inv… | |
CVE-2026-6082 | | 2026-09-25 | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inve… | |
CVE-2026-96752 | High | 7.2 | 2026-09-25 | The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all… |
CVE-2026-96568 | High | 7.2 | 2026-09-25 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to… |
CVE-2026-95866 | High | 7.2 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-95864 | High | 7.2 | 2026-09-25 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 du… |
CVE-2026-94573 | High | 7.2 | 2026-09-25 | The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and i… |
CVE-2026-93747 | Medium | 6.4 | 2026-09-25 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. Th… |
CVE-2026-93656 | Medium | 6.4 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-93654 | High | 7.2 | 2026-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parame… |
CVE-2026-88996 | Medium | 6.1 | 2026-09-25 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2026-84280 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions u… |
CVE-2026-17577 | Medium | 6.1 | 2026-09-25 | The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42… |
CVE-2026-13179 | Medium | 6.4 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2026-96766 | Medium | 6.4 | 2026-09-25 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bu… |
CVE-2026-96039 | High | 7.2 | 2026-09-25 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27… |
CVE-2026-94376 | Medium | 6.4 | 2026-09-25 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via U… |
CVE-2026-93897 | Medium | 6.4 | 2026-09-25 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-ty… |
CVE-2026-93303 | High | 7.2 | 2026-09-25 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich T… |
CVE-2026-92746 | Medium | 6.4 | 2026-09-25 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixM… |
CVE-2026-92212 | Medium | 6.1 | 2026-09-25 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parame… |
CVE-2026-84281 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions… |
CVE-2026-84279 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and inclu… |
CVE-2026-83591 | High | 7.2 | 2026-09-25 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all… |
CVE-2026-78393 | Medium | 6.1 | 2026-09-25 | The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its fr… |
CVE-2026-97735 | High | 8.0 | 2026-09-25 | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrar… |
CVE-2025-14814 | Medium | 6.4 | 2026-09-25 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and… |
CVE-2026-97650 | Medium | 4.3 | 2026-09-25 | A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function e… |
CVE-2026-97723 | Medium | 5.4 | 2026-09-25 | madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in ch… |
CVE-2026-48543 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48542 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48541 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48540 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-97322 | Medium | 4.3 | 2026-09-24 | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn… |
CVE-2026-61825 | High | 8.7 | 2026-09-24 | code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scr… |
CVE-2026-61823 | High | 7.3 | 2026-09-24 | code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scr… |
CVE-2026-57440 | High | 7.5 | 2026-09-24 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2026-97233 | Low | 3.5 | 2026-09-24 | A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component… |
CVE-2026-93405 | Medium | 6.1 | 2026-09-24 | Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Sn… |
CVE-2026-91121 | Medium | 5.0 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message… |
CVE-2026-91120 | Medium | 5.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds cou… |
CVE-2026-91119 | Medium | 6.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components… |
CVE-2026-61784 | Medium | 6.1 | 2026-09-24 | xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entit… |
CVE-2026-91122 | High | 8.7 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to c… |
CVE-2026-63498 | High | 8.7 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an aut… |
CVE-2026-62368 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app… |
CVE-2026-96873 | | 2026-09-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. … | |
CVE-2026-97224 | Medium | 4.3 | 2026-09-24 | A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the com… |
CVE-2026-56736 | High | 8.2 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated u… |
CVE-2026-12559 | | 2026-09-24 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. U… | |
CVE-2026-97062 | Medium | 5.4 | 2026-09-24 | Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authentic… |
CVE-2026-4637 | | 2026-09-24 | Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a no… | |
CVE-2026-15731 | Medium | 6.4 | 2026-09-24 | The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions u… |
CVE-2026-11744 | | 2026-09-24 | An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received… | |
CVE-2026-89005 | Medium | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is e… |
CVE-2026-89002 | Medium | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it… |
CVE-2026-84151 | Low | 3.5 | 2026-09-24 | The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowin… |
CVE-2026-96810 | Low | 3.5 | 2026-09-24 | A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-a… |
CVE-2026-96739 | Medium | 4.3 | 2026-09-24 | A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEdit… |
CVE-2026-66077 | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT… | |
CVE-2026-84683 | High | 8.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update st… |
CVE-2026-95586 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. |
CVE-2026-95530 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. |
CVE-2026-95529 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. |
CVE-2026-95528 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. |
CVE-2026-95515 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
CVE-2026-94682 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. |
CVE-2026-94680 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94671 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94500 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. |
CVE-2026-94461 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
CVE-2026-94391 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
CVE-2026-94179 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. |
CVE-2026-94176 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. |
CVE-2026-94168 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. |
CVE-2026-94118 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. |
CVE-2026-93774 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. |
CVE-2026-93772 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
CVE-2026-93622 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. |
CVE-2026-93618 | Medium | 6.5 | 2026-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. T… |
CVE-2026-93526 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |
CVE-2026-92730 | | 2026-09-23 | LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page. | |
CVE-2026-77394 | High | 7.6 | 2026-09-23 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticate… |
CVE-2026-91775 | | 2026-09-23 | LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulti… | |
CVE-2026-93769 | | 2026-09-23 | HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage User… | |
CVE-2026-18872 | Critical | 9.3 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React c… |
CVE-2026-63002 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the medi… |
CVE-2026-63001 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a… |
CVE-2026-59167 | Critical | 10.0 | 2026-09-23 | SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not… |
CVE-2026-5696 | | 2026-09-23 | Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration pan… | |
CVE-2026-95626 | High | 8.3 | 2026-09-23 | Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes dat… |
CVE-2026-91999 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91928 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91852 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |