CWE-79 · Cross-site Scripting (page 77)
Page 77 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13622 | Medium | 6.1 | 2025-12-05 | The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0… |
CVE-2025-13512 | Medium | 6.1 | 2025-12-05 | The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, a… |
CVE-2025-12368 | Medium | 6.4 | 2025-12-05 | The Sermon Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sermon-views` shortcode in all versions up to, and including, 2.3… |
CVE-2025-12191 | Medium | 5.4 | 2025-12-05 | The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' AJAX action in all versions up to, and i… |
CVE-2025-12163 | Medium | 6.4 | 2025-12-05 | The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insuffi… |
CVE-2025-12124 | Medium | 4.4 | 2025-12-05 | The FitVids for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.1 due… |
CVE-2025-12417 | Medium | 6.4 | 2025-12-05 | The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'surveyfunnel_lite_survey' shortcode i… |
CVE-2025-12804 | Medium | 6.4 | 2025-12-05 | The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and in… |
CVE-2025-66563 | Medium | 6.1 | 2025-12-04 | Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute… |
CVE-2025-66561 | High | 7.3 | 2025-12-04 | SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticate… |
CVE-2025-6946 | Medium | 4.8 | 2025-12-04 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticat… |
CVE-2025-13939 | Medium | 6.1 | 2025-12-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controlle… |
CVE-2025-13938 | Medium | 6.1 | 2025-12-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integr… |
CVE-2025-13937 | Medium | 6.1 | 2025-12-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Int… |
CVE-2025-13936 | Medium | 6.1 | 2025-12-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integr… |
CVE-2025-66574 | Medium | 5.4 | 2025-12-04 | TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session co… |
CVE-2025-65959 | High | 8.7 | 2025-12-04 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered i… |
CVE-2023-53735 | | 2025-12-04 | WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaSc… | |
CVE-2025-63499 | Medium | 6.1 | 2025-12-04 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. |
CVE-2025-59788 | Medium | 6.4 | 2025-12-04 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-13488 | | 2025-12-04 | Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may al… | |
CVE-2025-65516 | Medium | 6.1 | 2025-12-04 | A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Gol… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-41080 | Medium | 6.1 | 2025-12-04 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi… |
CVE-2025-41079 | Medium | 6.1 | 2025-12-04 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi… |
CVE-2025-13513 | Medium | 6.1 | 2025-12-04 | The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and includi… |
CVE-2025-11727 | High | 7.2 | 2025-12-04 | The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-65027 | High | 7.6 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestric… |
CVE-2025-66222 | Critical | 9.6 | 2025-12-03 | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid dia… |
CVE-2025-63401 | Medium | 5.5 | 2025-12-03 | Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing dir… |
CVE-2025-20385 | Low | 2.4 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a us… |
CVE-2025-57202 | Medium | 6.1 | 2025-12-03 | A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 allows attacker… |
CVE-2025-65267 | Critical | 9.0 | 2025-12-03 | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payloa… |
CVE-2025-13401 | Medium | 6.4 | 2025-12-03 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3… |
CVE-2025-13448 | Medium | 6.4 | 2025-12-03 | The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and in… |
CVE-2025-66468 | High | 7.6 | 2025-12-02 | The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 202… |
CVE-2025-66460 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo pass… |
CVE-2025-66459 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnera… |
CVE-2025-66458 | Medium | 6.1 | 2025-12-02 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are mul… |
CVE-2025-13639 | High | 8.1 | 2025-12-02 | Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2025-65881 | Medium | 6.1 | 2025-12-02 | Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. |
CVE-2025-65215 | Medium | 6.1 | 2025-12-02 | Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Suppli… |
CVE-2025-65186 | Medium | 6.1 | 2025-12-02 | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor… |
CVE-2025-64070 | Medium | 5.4 | 2025-12-02 | Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. |
CVE-2025-65187 | Medium | 6.1 | 2025-12-02 | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScrip… |
CVE-2025-63872 | Medium | 6.1 | 2025-12-02 | DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content. |
CVE-2025-13505 | Medium | 4.8 | 2025-12-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-13731 | Medium | 6.4 | 2025-12-02 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nxt-year' shortcode in all… |
CVE-2025-40700 | Medium | 6.1 | 2025-12-02 | Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a… |
CVE-2025-13873 | Medium | 5.4 | 2025-12-02 | Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary J… |
CVE-2025-13007 | Medium | 6.1 | 2025-12-02 | The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t… |
CVE-2025-13387 | High | 7.2 | 2025-12-02 | The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and inclu… |
CVE-2025-13697 | Medium | 6.4 | 2025-12-02 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored C… |
CVE-2025-66412 | Medium | 5.4 | 2025-12-01 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, a… |
CVE-2025-66403 | Medium | 4.6 | 2025-12-01 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vul… |
CVE-2025-66312 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66311 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66310 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66309 | Medium | 6.1 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66308 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-65622 | Medium | 5.4 | 2025-12-01 | Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in a… |
CVE-2025-65621 | Medium | 5.4 | 2025-12-01 | Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enablin… |
CVE-2025-63317 | Medium | 5.4 | 2025-12-01 | Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes… |
CVE-2025-13835 | Medium | 6.5 | 2025-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-63534 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. The application fails to properly san… |
CVE-2025-63533 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The applica… |
CVE-2025-64030 | Medium | 5.4 | 2025-12-01 | Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/servlets/WSTrxManager… |
CVE-2025-63528 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. The application fails to properl… |
CVE-2025-63527 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. The applica… |
CVE-2025-63526 | High | 8.5 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System within the abs.php component. The application fails to properly sanitize… |
CVE-2025-63520 | Medium | 6.1 | 2025-12-01 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate). |
CVE-2025-41070 | | 2025-12-01 | Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's brows… | |
CVE-2025-13802 | Medium | 4.3 | 2025-12-01 | A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the componen… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |
CVE-2025-13793 | Medium | 4.3 | 2025-11-30 | A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown funct… |
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-66421 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69. |
CVE-2025-66420 | Medium | 5.4 | 2025-11-30 | Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67. |
CVE-2025-65892 | Medium | 6.1 | 2025-11-29 | Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's… |
CVE-2025-65540 | Medium | 6.1 | 2025-11-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and… |
CVE-2025-66036 | Medium | 6.1 | 2025-11-29 | Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input ha… |
CVE-2025-51734 | Medium | 5.4 | 2025-11-28 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-66359 | High | 8.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scri… |
CVE-2025-13692 | High | 7.2 | 2025-11-27 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-13525 | Medium | 6.1 | 2025-11-27 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1… |
CVE-2025-12185 | Medium | 4.4 | 2025-11-27 | The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insuffici… |
CVE-2025-12123 | Medium | 6.1 | 2025-11-27 | The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versi… |
CVE-2025-12151 | Medium | 6.4 | 2025-11-27 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1… |
CVE-2025-12713 | Medium | 6.4 | 2025-11-27 | The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due… |
CVE-2025-12712 | Medium | 6.4 | 2025-11-27 | The Shouty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shouty shortcode in all versions up to, and including, 0.2.1 due to insuff… |
CVE-2025-12670 | Medium | 6.4 | 2025-11-27 | The wp-twitpic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'twitpic' shortcode in all versions up to, and… |
CVE-2025-12666 | Medium | 6.4 | 2025-11-27 | The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' s… |