CWE-79 · Cross-site Scripting (page 73)
Page 73 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-53898 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert i… |
CVE-2023-53897 | Medium | 5.4 | 2025-12-16 | Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can i… |
CVE-2025-68268 | Medium | 5.4 | 2025-12-16 | In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page |
CVE-2025-68166 | Medium | 5.4 | 2025-12-16 | In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab |
CVE-2025-68165 | Medium | 5.4 | 2025-12-16 | In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup |
CVE-2025-68163 | Low | 3.5 | 2025-12-16 | In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page |
CVE-2025-11220 | Medium | 6.4 | 2025-12-16 | The Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Text Path widget in all versions up to, and including, 3.33.3… |
CVE-2025-68080 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded al… |
CVE-2025-68079 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows… |
CVE-2025-68078 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows St… |
CVE-2025-68077 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This… |
CVE-2025-68076 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored… |
CVE-2025-68070 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-p… |
CVE-2025-67986 | Medium | 5.9 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite… |
CVE-2025-67983 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-st… |
CVE-2025-67951 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addon… |
CVE-2025-67912 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-… |
CVE-2025-68115 | Medium | 6.1 | 2025-12-16 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflect… |
CVE-2025-14722 | Low | 2.4 | 2025-12-15 | A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/Ad… |
CVE-2023-53891 | Medium | 5.4 | 2025-12-15 | Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into page content. Attackers… |
CVE-2023-53890 | Medium | 5.4 | 2025-12-15 | Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Atta… |
CVE-2023-53887 | Medium | 5.4 | 2025-12-15 | Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages. Attackers can cr… |
CVE-2023-53884 | Medium | 5.4 | 2025-12-15 | Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaSc… |
CVE-2023-53882 | | 2025-12-15 | JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attack… | |
CVE-2023-53880 | | 2025-12-15 | Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative i… | |
CVE-2023-53870 | | 2025-12-15 | Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can… | |
CVE-2025-51962 | Medium | 6.1 | 2025-12-15 | A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2023-36337 | Medium | 6.1 | 2025-12-15 | A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitra… |
CVE-2025-66843 | Medium | 5.4 | 2025-12-15 | grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with… |
CVE-2025-14387 | Medium | 6.4 | 2025-12-15 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insu… |
CVE-2025-13728 | Medium | 6.4 | 2025-12-15 | The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2025-13610 | Medium | 6.4 | 2025-12-15 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-13608 | Medium | 6.4 | 2025-12-15 | The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in all versions up to, and including, 2.0… |
CVE-2025-13367 | Medium | 6.4 | 2025-12-15 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress i… |
CVE-2025-65778 | High | 8.1 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-cont… |
CVE-2025-37732 | Medium | 5.4 | 2025-12-15 | Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s… |
CVE-2025-67906 | Medium | 5.4 | 2025-12-15 | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. |
CVE-2025-13740 | Medium | 6.4 | 2025-12-15 | The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions… |
CVE-2025-14691 | Medium | 4.3 | 2025-12-14 | A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in… |
CVE-2025-14663 | Low | 2.4 | 2025-12-14 | A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.p… |
CVE-2025-14662 | Low | 2.4 | 2025-12-14 | A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component… |
CVE-2025-12537 | Medium | 6.4 | 2025-12-14 | The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to… |
CVE-2025-9873 | Medium | 6.4 | 2025-12-13 | The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.5 due to insufficient input saniti… |
CVE-2025-9856 | Medium | 6.4 | 2025-12-13 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2025-9488 | Medium | 6.4 | 2025-12-13 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due… |
CVE-2025-8780 | Medium | 6.4 | 2025-12-13 | The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all… |
CVE-2025-8779 | Medium | 6.4 | 2025-12-13 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets i… |
CVE-2025-8687 | Medium | 6.4 | 2025-12-13 | The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up t… |
CVE-2025-8617 | Medium | 6.4 | 2025-12-13 | The YITH WooCommerce Quick View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yith_quick_view shortcode in all versions up… |
CVE-2025-8199 | Medium | 6.4 | 2025-12-13 | The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee widget in all versions up to, and incl… |
CVE-2025-8195 | Medium | 6.4 | 2025-12-13 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all v… |
CVE-2025-7960 | Medium | 6.4 | 2025-12-13 | The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image… |
CVE-2025-7058 | Medium | 6.4 | 2025-12-13 | The Kingcabs theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.1.9… |
CVE-2025-36750 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page vi… |
CVE-2025-36748 | Medium | 5.4 | 2025-12-13 | ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the… |
CVE-2025-14378 | Medium | 4.4 | 2025-12-13 | The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to in… |
CVE-2025-14278 | Medium | 6.4 | 2025-12-13 | The HT Slider for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_title' parameter in all versions up to, and includ… |
CVE-2025-14056 | Medium | 4.4 | 2025-12-13 | The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versi… |
CVE-2025-13705 | Medium | 6.4 | 2025-12-13 | The Custom Frames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'customframe' shortcode in all versions up… |
CVE-2025-12109 | Medium | 6.4 | 2025-12-13 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the script adder pr… |
CVE-2025-12077 | Medium | 6.1 | 2025-12-13 | The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9… |
CVE-2025-12076 | Medium | 6.1 | 2025-12-13 | The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and includi… |
CVE-2025-11376 | Medium | 6.4 | 2025-12-13 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_loop' shortcode in all versions up to, and… |
CVE-2025-67634 | Medium | 4.4 | 2025-12-12 | The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could c… |
CVE-2025-14580 | Low | 3.5 | 2025-12-12 | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/bi… |
CVE-2025-67734 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers… |
CVE-2024-58305 | High | 8.8 | 2025-12-12 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. At… |
CVE-2025-8082 | Medium | 6.3 | 2025-12-12 | Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a… |
CVE-2025-67342 | Medium | 4.6 | 2025-12-12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter… |
CVE-2025-67344 | Medium | 4.6 | 2025-12-12 | jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. |
CVE-2025-67341 | Medium | 4.6 | 2025-12-12 | jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Ad… |
CVE-2025-36746 | Medium | 5.4 | 2025-12-12 | SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may exec… |
CVE-2025-14030 | Medium | 6.4 | 2025-12-12 | The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22… |
CVE-2025-12965 | Medium | 6.4 | 2025-12-12 | The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion w… |
CVE-2025-13993 | Medium | 5.5 | 2025-12-12 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' par… |
CVE-2025-67730 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to ad… |
CVE-2025-4970 | Medium | 5.5 | 2025-12-12 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to i… |
CVE-2025-14049 | Medium | 6.1 | 2025-12-12 | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versio… |
CVE-2025-11876 | Medium | 6.4 | 2025-12-12 | The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versi… |
CVE-2025-12570 | High | 7.2 | 2025-12-12 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 d… |
CVE-2025-67724 | Medium | 5.4 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP header… |
CVE-2025-66492 | High | 8.2 | 2025-12-12 | Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 throug… |
CVE-2025-66284 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION… |
CVE-2025-65120 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZI… |
CVE-2025-57883 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZI… |
CVE-2025-54407 | Medium | 6.1 | 2025-12-12 | Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-53523 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-14467 | Medium | 4.4 | 2025-12-12 | The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin expl… |
CVE-2025-14393 | Medium | 6.4 | 2025-12-12 | The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and inclu… |
CVE-2025-14143 | Medium | 6.4 | 2025-12-12 | The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up t… |
CVE-2025-14138 | Medium | 6.1 | 2025-12-12 | The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14137 | Medium | 6.1 | 2025-12-12 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and in… |
CVE-2025-14132 | Medium | 6.1 | 2025-12-12 | The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14129 | Medium | 6.1 | 2025-12-12 | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14125 | Medium | 6.1 | 2025-12-12 | The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including… |
CVE-2025-14119 | Medium | 6.4 | 2025-12-12 | The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_vid… |
CVE-2025-14048 | Medium | 4.4 | 2025-12-12 | The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1… |
CVE-2025-14035 | Medium | 4.4 | 2025-12-12 | The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and incl… |
CVE-2025-14032 | Medium | 6.4 | 2025-12-12 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in al… |
CVE-2025-13989 | Medium | 6.4 | 2025-12-12 | The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including… |