CWE-79 · Cross-site Scripting (page 79)
Page 79 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53223 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded al… |
CVE-2025-53220 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This… |
CVE-2025-53215 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflec… |
CVE-2025-49407 | High | 8.8 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affect… |
CVE-2025-48365 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored… |
CVE-2025-48360 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows… |
CVE-2025-48358 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommer… |
CVE-2025-48356 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affec… |
CVE-2025-48354 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Element… |
CVE-2025-48352 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger… |
CVE-2025-48349 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smar… |
CVE-2025-48347 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bx… |
CVE-2025-48324 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-… |
CVE-2025-48323 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allo… |
CVE-2025-48322 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XS… |
CVE-2025-48319 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reser… |
CVE-2025-48316 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobi… |
CVE-2025-48315 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Sto… |
CVE-2025-48314 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored… |
CVE-2025-48313 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode a… |
CVE-2025-48312 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Sto… |
CVE-2025-48305 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreo… |
CVE-2025-48110 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue… |
CVE-2025-55175 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, wh… |
CVE-2025-54544 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arb… |
CVE-2025-54543 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbit… |
CVE-2025-54540 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when o… |
CVE-2025-8073 | Medium | 6.4 | 2025-08-28 | The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up… |
CVE-2025-6255 | Medium | 6.4 | 2025-08-28 | The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all version… |
CVE-2025-9346 | Medium | 6.4 | 2025-08-28 | The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insuff… |
CVE-2025-8603 | Medium | 6.4 | 2025-08-28 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including… |
CVE-2025-9352 | Medium | 5.4 | 2025-08-28 | The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4… |
CVE-2025-9344 | Medium | 6.4 | 2025-08-28 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-8897 | Medium | 6.1 | 2025-08-28 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all version… |
CVE-2025-34521 | Medium | 5.4 | 2025-08-27 | A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is… |
CVE-2025-55618 | High | 7.3 | 2025-08-27 | In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendere… |
CVE-2025-58216 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Thumbtack Review Slider wp-thumbtack-review-… |
CVE-2025-58213 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ameliabooking Booking System Trafft booking-system-trafft… |
CVE-2025-58212 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows DOM-Based… |
CVE-2025-58211 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Stored… |
CVE-2025-58209 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue… |
CVE-2025-58208 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Templ… |
CVE-2025-58205 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2025-58197 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mra13 Simple Download Monitor simple-download-monitor all… |
CVE-2025-58196 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS… |
CVE-2025-58195 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows S… |
CVE-2025-58194 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2025-55422 | High | 8.8 | 2025-08-27 | In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus. |
CVE-2025-50977 | Medium | 6.1 | 2025-08-27 | A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access f… |
CVE-2025-34157 | Critical | 9.0 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated use… |
CVE-2025-20296 | Medium | 5.4 | 2025-08-27 | A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-sit… |
CVE-2025-50978 | Medium | 6.1 | 2025-08-27 | In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. By injecting a specially crafted p… |
CVE-2025-50986 | Medium | 5.6 | 2025-08-27 | diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various… |
CVE-2025-50985 | Medium | 5.6 | 2025-08-27 | diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. Unsanitized GET parameters inc… |
CVE-2025-30036 | | 2025-08-27 | Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code… | |
CVE-2025-49039 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue… |
CVE-2025-49035 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin Menu Groups admin-menu-groups allows S… |
CVE-2025-7732 | Medium | 6.4 | 2025-08-27 | The Lazy Load for Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lazy‑loading handlers in all versions up to, and including… |
CVE-2025-8490 | Medium | 4.4 | 2025-08-27 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7… |
CVE-2025-9277 | Medium | 6.4 | 2025-08-26 | The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, an… |
CVE-2024-35203 | Medium | 6.1 | 2025-08-26 | Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Ma… |
CVE-2025-50975 | Medium | 5.4 | 2025-08-26 | IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark… |
CVE-2025-50976 | Medium | 6.1 | 2025-08-26 | IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, res… |
CVE-2025-57425 | Medium | 6.1 | 2025-08-26 | A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript i… |
CVE-2025-52184 | Medium | 6.1 | 2025-08-26 | Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion. |
CVE-2025-56432 | Medium | 6.1 | 2025-08-26 | A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context… |
CVE-2025-52217 | Medium | 5.4 | 2025-08-26 | SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing inject… |
CVE-2025-52037 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the… |
CVE-2025-52036 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation o… |
CVE-2025-52035 | Medium | 6.1 | 2025-08-26 | A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XS… |
CVE-2024-45753 | Medium | 6.1 | 2025-08-26 | In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute. |
CVE-2025-9440 | Medium | 4.3 | 2025-08-26 | A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown f… |
CVE-2025-9439 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-9438 | Medium | 4.3 | 2025-08-26 | A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-9434 | Medium | 4.3 | 2025-08-26 | A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/… |
CVE-2025-9433 | Medium | 4.3 | 2025-08-26 | A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Pe… |
CVE-2025-9432 | Medium | 4.3 | 2025-08-26 | A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Pane… |
CVE-2025-9431 | Medium | 4.3 | 2025-08-26 | A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site s… |
CVE-2025-9430 | Low | 2.4 | 2025-08-26 | A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the… |
CVE-2025-9429 | Low | 3.5 | 2025-08-26 | A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post H… |
CVE-2025-9422 | Low | 2.4 | 2025-08-25 | A vulnerability was found in oitcode samarium up to 0.9.6. This impacts an unknown function of the file /dashboard/team of the component Team Image Handler. Th… |
CVE-2025-9416 | Low | 2.4 | 2025-08-25 | A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages I… |
CVE-2025-55574 | Medium | 6.1 | 2025-08-25 | Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code |
CVE-2025-55409 | High | 8.8 | 2025-08-25 | FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. |
CVE-2025-3478 | | 2025-08-25 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. | |
CVE-2024-39923 | Medium | 6.1 | 2025-08-25 | An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cr… |
CVE-2025-9407 | Low | 3.5 | 2025-08-25 | A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulat… |
CVE-2025-54301 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped. | |
CVE-2025-54300 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads. | |
CVE-2025-9404 | Low | 2.4 | 2025-08-25 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder… |
CVE-2025-9388 | Low | 3.5 | 2025-08-24 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument… |
CVE-2025-8208 | Medium | 6.4 | 2025-08-24 | The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and i… |
CVE-2025-5352 | Critical | 9.6 | 2025-08-23 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_C… |
CVE-2025-9131 | Medium | 6.4 | 2025-08-23 | The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 d… |
CVE-2025-8062 | Medium | 6.4 | 2025-08-23 | The WS Theme Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ws_weather shortcode in all versions up to, and includin… |
CVE-2025-7957 | Medium | 6.4 | 2025-08-23 | The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up to, and including… |
CVE-2025-43765 | Medium | 6.1 | 2025-08-23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 t… |
CVE-2025-43769 | Medium | 6.1 | 2025-08-23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024… |
CVE-2025-43770 | Medium | 6.1 | 2025-08-23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 thro… |
CVE-2025-43761 | Medium | 6.1 | 2025-08-22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 thro… |