CWE-79 · Cross-site Scripting (page 78)
Page 78 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12649 | Medium | 6.4 | 2025-11-27 | The SortTable Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the sorttablepost shortcode in all versions up t… |
CVE-2024-5540 | | 2025-11-27 | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious… | |
CVE-2025-66040 | Low | 3.6 | 2025-11-27 | Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server… |
CVE-2025-65676 | Medium | 5.4 | 2025-11-26 | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. |
CVE-2025-65675 | Medium | 5.4 | 2025-11-26 | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pict… |
CVE-2025-64130 | Critical | 9.8 | 2025-11-26 | Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the v… |
CVE-2025-65237 | Medium | 6.1 | 2025-11-26 | A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the cont… |
CVE-2025-9163 | Medium | 6.1 | 2025-11-26 | The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficien… |
CVE-2025-66026 | Medium | 6.1 | 2025-11-26 | REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request paramet… |
CVE-2025-66021 | Medium | 6.1 | 2025-11-26 | OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while pro… |
CVE-2025-12848 | Medium | 6.1 | 2025-11-26 | Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker c… |
CVE-2025-66258 | Medium | 5.4 | 2025-11-26 | Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000… |
CVE-2025-65956 | Medium | 6.5 | 2025-11-26 | Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cro… |
CVE-2025-63735 | Medium | 6.1 | 2025-11-25 | A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal endpoint selfguestpass… |
CVE-2025-21621 | Medium | 6.1 | 2025-11-25 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting (XSS) vulnera… |
CVE-2025-65961 | Low | 3.3 | 2025-11-25 | Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output tha… |
CVE-2025-64049 | Medium | 4.8 | 2025-11-25 | A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or… |
CVE-2025-60739 | Critical | 9.6 | 2025-11-25 | Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a r… |
CVE-2025-40890 | High | 7.9 | 2025-11-25 | A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticate… |
CVE-2025-0248 | High | 8.1 | 2025-11-25 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticat… |
CVE-2025-13383 | Medium | 6.1 | 2025-11-25 | The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the… |
CVE-2025-13311 | Medium | 4.4 | 2025-11-25 | The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting in all versions up to, and including, 1… |
CVE-2025-12645 | Medium | 6.4 | 2025-11-25 | The Inline frame – Iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedsite' shortcode in all versions up to, and including… |
CVE-2025-12032 | Medium | 4.4 | 2025-11-25 | The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlam_zsocial_save_messager’… |
CVE-2025-12025 | Medium | 4.4 | 2025-11-25 | The YouTube Subscribe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to i… |
CVE-2025-64730 | Medium | 6.1 | 2025-11-25 | Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browse… |
CVE-2025-13068 | High | 7.2 | 2025-11-25 | The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username in all versions up to, and including, 4… |
CVE-2025-63498 | Medium | 6.1 | 2025-11-24 | alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. |
CVE-2025-64048 | Medium | 6.1 | 2025-11-24 | YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost… |
CVE-2025-64047 | Medium | 6.1 | 2025-11-24 | OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. |
CVE-2025-60917 | Medium | 4.6 | 2025-11-24 | A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows at… |
CVE-2025-60916 | Medium | 5.4 | 2025-11-24 | A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows at… |
CVE-2025-60914 | Medium | 4.6 | 2025-11-24 | Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted G… |
CVE-2025-10555 | High | 8.7 | 2025-11-24 | A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows a… |
CVE-2025-10554 | High | 8.7 | 2025-11-24 | A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENC… |
CVE-2025-41087 | | 2025-11-24 | Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the att… | |
CVE-2025-12739 | | 2025-11-24 | An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Explo… | |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13589 | | 2025-11-24 | FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitra… | |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-11186 | Medium | 6.4 | 2025-11-22 | The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in… |
CVE-2025-66111 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XS… |
CVE-2025-66098 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS… |
CVE-2025-66093 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map… |
CVE-2025-66092 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored X… |
CVE-2025-66091 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator al… |
CVE-2025-66090 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based… |
CVE-2025-66081 | Medium | 5.9 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XS… |
CVE-2025-66067 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DO… |
CVE-2025-66066 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This i… |
CVE-2025-66057 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows DOM… |
CVE-2025-66053 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects… |
CVE-2025-12935 | Medium | 6.4 | 2025-11-21 | The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cr… |
CVE-2025-12964 | Medium | 6.4 | 2025-11-21 | The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in… |
CVE-2025-12160 | High | 7.2 | 2025-11-21 | The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and inc… |
CVE-2025-12066 | Medium | 4.4 | 2025-11-21 | The WP Delete Post Copies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due… |
CVE-2025-13141 | Medium | 6.4 | 2025-11-21 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions… |
CVE-2025-11826 | Medium | 6.4 | 2025-11-21 | The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versi… |
CVE-2025-11808 | Medium | 6.4 | 2025-11-21 | The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, an… |
CVE-2025-11803 | Medium | 6.4 | 2025-11-21 | The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the '… |
CVE-2025-13159 | High | 7.1 | 2025-11-21 | The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and… |
CVE-2025-13135 | Medium | 6.4 | 2025-11-21 | The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to… |
CVE-2025-12746 | Medium | 6.1 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to… |
CVE-2025-12661 | Medium | 6.4 | 2025-11-21 | The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all vers… |
CVE-2025-12660 | Medium | 6.4 | 2025-11-21 | The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up… |
CVE-2025-12135 | High | 7.2 | 2025-11-21 | The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to… |
CVE-2025-11885 | Medium | 6.1 | 2025-11-21 | The EchBay Admin Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_ebnonce' parameter in all versions up to, and includin… |
CVE-2025-11802 | Medium | 6.4 | 2025-11-21 | The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode i… |
CVE-2025-11801 | Medium | 6.4 | 2025-11-21 | The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versi… |
CVE-2025-11800 | Medium | 6.4 | 2025-11-21 | The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in… |
CVE-2025-11799 | Medium | 6.4 | 2025-11-21 | The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all v… |
CVE-2025-11770 | Medium | 6.4 | 2025-11-21 | The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-tim… |
CVE-2025-11768 | Medium | 6.4 | 2025-11-21 | The Islamic Phrases plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phrases' shortcode attribute in all versions up to, and includin… |
CVE-2025-11767 | Medium | 6.4 | 2025-11-21 | The Tips Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tip' shortcode in all versions up to, and including, 0.2.1. This… |
CVE-2025-11765 | Medium | 6.4 | 2025-11-21 | The Stock Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_height' and 'image_width' shortcode attributes in all versions… |
CVE-2025-11764 | Medium | 6.4 | 2025-11-21 | The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in the [notification] shortcode in all vers… |
CVE-2025-11763 | Medium | 6.4 | 2025-11-21 | The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode… |
CVE-2025-61949 | Medium | 5.4 | 2025-11-21 | LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be ex… |
CVE-2025-62459 | High | 8.3 | 2025-11-20 | Microsoft Defender Portal Spoofing Vulnerability |
CVE-2025-13484 | Low | 2.4 | 2025-11-20 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/cus… |
CVE-2025-36153 | Medium | 6.1 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code… |
CVE-2025-55124 | Medium | 6.1 | 2025-11-20 | Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script. |
CVE-2025-55123 | Medium | 5.4 | 2025-11-20 | Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own a… |
CVE-2025-52668 | Medium | 5.4 | 2025-11-20 | Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosu… |
CVE-2025-52667 | Medium | 5.4 | 2025-11-20 | Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in… |
CVE-2025-48987 | Medium | 6.1 | 2025-11-20 | Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. |
CVE-2025-35029 | Low | 3.5 | 2025-11-20 | Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary conten… |
CVE-2025-55126 | Medium | 6.5 | 2025-11-20 | HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages… |
CVE-2025-64027 | Medium | 6.1 | 2025-11-20 | Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, t… |
CVE-2025-63848 | Medium | 6.1 | 2025-11-20 | Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook. |
CVE-2025-62731 | Medium | 4.8 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS i… |
CVE-2025-62729 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be ren… |
CVE-2025-62297 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which wil… |
CVE-2025-62296 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will… |
CVE-2025-62295 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which… |
CVE-2025-60737 | Medium | 6.1 | 2025-11-20 | Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execut… |
CVE-2025-64984 | Medium | 6.1 | 2025-11-20 | Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial… |
CVE-2025-60796 | Medium | 6.1 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parame… |
CVE-2025-5092 | Medium | 6.4 | 2025-11-20 | Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |