CWE-79 · Cross-site Scripting (page 76)
Page 76 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9857 | Medium | 6.4 | 2025-09-10 | The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode i… |
CVE-2025-9367 | Medium | 5.5 | 2025-09-10 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insu… |
CVE-2025-10126 | Medium | 6.4 | 2025-09-10 | The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and includi… |
CVE-2025-8388 | Medium | 6.4 | 2025-09-10 | The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor_url’… |
CVE-2025-49461 | Medium | 4.3 | 2025-09-09 | Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-7746 | | 2025-09-09 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected… | |
CVE-2025-58768 | Critical | 9.6 | 2025-09-09 | DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of dir… |
CVE-2025-58765 | High | 7.1 | 2025-09-09 | wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2025-44595 | Medium | 6.1 | 2025-09-09 | Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}. |
CVE-2025-44593 | Medium | 6.1 | 2025-09-09 | Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger st… |
CVE-2025-34178 | Medium | 5.4 | 2025-09-09 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being direc… |
CVE-2025-34177 | Medium | 5.4 | 2025-09-09 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being direc… |
CVE-2025-58430 | Medium | 6.1 | 2025-09-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the sessio… |
CVE-2025-55054 | Medium | 6.1 | 2025-09-09 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2025-43786 | Medium | 5.3 | 2025-09-09 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024… |
CVE-2025-36125 | Medium | 6.4 | 2025-09-09 | IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-34175 | Medium | 6.1 | 2025-09-09 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related cha… |
CVE-2025-34174 | Medium | 5.4 | 2025-09-09 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related… |
CVE-2025-34172 | Medium | 6.1 | 2025-09-09 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests… |
CVE-2025-43781 | Medium | 6.1 | 2025-09-09 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 throug… |
CVE-2025-43775 | Medium | 5.4 | 2025-09-09 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024… |
CVE-2025-57665 | Medium | 6.4 | 2025-09-09 | Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that… |
CVE-2025-58990 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.Th… |
CVE-2025-58989 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dy… |
CVE-2025-58988 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This i… |
CVE-2025-58987 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.Th… |
CVE-2025-58985 | Medium | 6.5 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce… |
CVE-2025-58984 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored… |
CVE-2025-58983 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.Thi… |
CVE-2025-58982 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-prote… |
CVE-2025-57540 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment… |
CVE-2025-57539 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authe… |
CVE-2025-57538 | Medium | 5.4 | 2025-09-09 | A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 al… |
CVE-2025-54252 | Medium | 5.4 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileg… |
CVE-2025-47694 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue aff… |
CVE-2025-47570 | High | 7.1 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-re… |
CVE-2025-30875 | Medium | 5.9 | 2025-09-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.Th… |
CVE-2025-55143 | Medium | 6.1 | 2025-09-09 | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iv… |
CVE-2025-52277 | Medium | 6.1 | 2025-09-09 | Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots… |
CVE-2025-43776 | Medium | 5.4 | 2025-09-09 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025… |
CVE-2025-9111 | Low | 3.5 | 2025-09-09 | The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2025-9061 | Medium | 6.4 | 2025-09-09 | The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient in… |
CVE-2025-9058 | Medium | 6.4 | 2025-09-09 | The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient in… |
CVE-2025-43778 | Medium | 6.1 | 2025-09-09 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 202… |
CVE-2025-42938 | Medium | 6.1 | 2025-09-09 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it p… |
CVE-2025-42920 | Medium | 6.1 | 2025-09-09 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and… |
CVE-2025-10117 | Low | 3.5 | 2025-09-09 | A weakness has been identified in SourceCodester Simple To-Do List System 1.0. Impacted is an unknown function of the file /fetch_tasks.php of the component Ad… |
CVE-2025-58746 | Critical | 9.0 | 2025-09-08 | The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus… |
CVE-2025-58452 | Medium | 6.1 | 2025-09-08 | WeGIA is a Web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_despachos.php endpoint of… |
CVE-2025-53838 | Medium | 5.4 | 2025-09-08 | LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior to 2.1.9 that all… |
CVE-2025-10099 | Low | 2.4 | 2025-09-08 | A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuar… |
CVE-2025-55998 | High | 8.1 | 2025-09-08 | A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in th… |
CVE-2025-52161 | Critical | 9.8 | 2025-09-08 | Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2025-40642 | | 2025-09-08 | Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request par… | |
CVE-2025-40641 | | 2025-09-08 | Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of us… | |
CVE-2014-125128 | Medium | 6.1 | 2025-09-08 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`h… |
CVE-2019-25225 | Medium | 6.1 | 2025-09-08 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content… |
CVE-2025-10088 | Low | 3.5 | 2025-09-08 | A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation o… |
CVE-2025-10075 | Low | 3.5 | 2025-09-08 | A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /manage-profile.php. T… |
CVE-2025-10074 | Low | 3.5 | 2025-09-08 | A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of… |
CVE-2025-10067 | Medium | 4.3 | 2025-09-07 | A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/data… |
CVE-2025-10066 | Medium | 4.3 | 2025-09-07 | A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/mai… |
CVE-2025-10065 | Medium | 4.3 | 2025-09-07 | A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/uni… |
CVE-2025-10064 | Medium | 4.3 | 2025-09-07 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendor… |
CVE-2025-10063 | Medium | 4.3 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datata… |
CVE-2025-10032 | Medium | 4.3 | 2025-09-06 | A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. The affected element is an unknown function of the file /index.php. The manip… |
CVE-2025-10029 | Low | 3.5 | 2025-09-06 | A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/d… |
CVE-2025-10028 | Low | 3.5 | 2025-09-06 | A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This affects an unknown part of the file /inventory/main/vendors/datatables/unit_t… |
CVE-2025-6757 | Medium | 6.4 | 2025-09-06 | The Recent Posts Widget Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rpwe' shortcode in all versions up to, and… |
CVE-2025-9493 | Medium | 6.4 | 2025-09-06 | The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1… |
CVE-2025-9442 | Medium | 6.4 | 2025-09-06 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all versions up to, and… |
CVE-2025-9126 | Medium | 6.4 | 2025-09-06 | The Smart Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.1 du… |
CVE-2025-8722 | Medium | 6.4 | 2025-09-06 | The Content Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid and List widgets in all versions up to, and including… |
CVE-2025-8564 | Medium | 6.4 | 2025-09-06 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.7 d… |
CVE-2025-8149 | Medium | 6.4 | 2025-09-06 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and… |
CVE-2025-9853 | Medium | 6.4 | 2025-09-06 | The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and in… |
CVE-2025-8360 | Medium | 6.4 | 2025-09-06 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions u… |
CVE-2025-9849 | Medium | 6.4 | 2025-09-06 | The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, a… |
CVE-2025-6067 | Medium | 6.4 | 2025-09-06 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` an… |
CVE-2025-10027 | Low | 3.5 | 2025-09-05 | A vulnerability was determined in itsourcecode POS Point of Sale System 1.0. Affected by this issue is some unknown functionality of the file /inventory/main/v… |
CVE-2025-10044 | Medium | 4.3 | 2025-09-05 | A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly… |
CVE-2025-10026 | Low | 3.5 | 2025-09-05 | A vulnerability was found in itsourcecode POS Point of Sale System 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory/main/… |
CVE-2025-9057 | Medium | 6.4 | 2025-09-05 | The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient… |
CVE-2025-53307 | High | 7.1 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder WordPress Assistant assistant allows Refle… |
CVE-2025-48105 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows… |
CVE-2025-48103 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allo… |
CVE-2025-48102 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Me… |
CVE-2025-8695 | Medium | 5.4 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This i… |
CVE-2025-58887 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG… |
CVE-2025-58886 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tan Nguyen Instant Locations instant-locations allows Sto… |
CVE-2025-58884 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS… |
CVE-2025-58883 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows St… |
CVE-2025-58882 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in w1zzard Simple Text Slider simple-text-slider allows Stor… |
CVE-2025-58880 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode transl… |
CVE-2025-58876 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows… |
CVE-2025-58875 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored X… |
CVE-2025-58874 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in josepsitjar StoryMap wp-storymap allows DOM-Based XSS.Thi… |
CVE-2025-58873 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows… |
CVE-2025-58871 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Paper Collapse Toggle master-paper-colla… |
CVE-2025-58870 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP-GraphViz wp-graphviz allows DOM-Based XSS.This… |