CWE-79 · Cross-site Scripting (page 8)
Page 8 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73192 | Medium | 6.1 | 2026-09-23 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache S… |
CVE-2026-5924 | Medium | 6.4 | 2026-09-23 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all vers… |
CVE-2026-91073 | Medium | 6.8 | 2026-09-23 | The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated… |
CVE-2026-88997 | Medium | 6.8 | 2026-09-23 | The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute i… |
CVE-2026-85006 | Medium | 6.8 | 2026-09-23 | The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML at… |
CVE-2025-15696 | Medium | 6.8 | 2026-09-23 | The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, all… |
CVE-2026-96258 | Medium | 4.3 | 2026-09-23 | A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html… |
CVE-2026-95957 | Medium | 4.3 | 2026-09-23 | A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signu… |
CVE-2026-18131 | High | 8.2 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser d… |
CVE-2026-95812 | Medium | 6.1 | 2026-09-22 | ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, an… |
CVE-2026-88020 | Medium | 6.1 | 2026-09-22 | Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to rout… |
CVE-2026-77912 | Medium | 5.4 | 2026-09-22 | A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML at… |
CVE-2026-76909 | | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/re… | |
CVE-2026-83801 | Medium | 5.4 | 2026-09-22 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relation… |
CVE-2026-88415 | High | 8.7 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter. |
CVE-2026-77272 | Medium | 5.4 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed… |
CVE-2026-75744 | High | 8.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to injec… |
CVE-2026-75698 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts int… |
CVE-2026-75697 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75689 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-75684 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-48361 | Medium | 6.1 | 2026-09-22 | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable… |
CVE-2026-95657 | Low | 3.5 | 2026-09-22 | A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectioni… |
CVE-2026-86062 | Medium | 6.1 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and th… |
CVE-2026-79311 | Medium | 6.1 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__(). |
CVE-2026-75510 | | 2026-09-22 | Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component acc… | |
CVE-2026-79315 | Medium | 4.7 | 2026-09-22 | A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding… |
CVE-2026-95682 | | 2026-09-22 | MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated… | |
CVE-2026-95665 | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/ev… | |
CVE-2026-95396 | Medium | 4.3 | 2026-09-22 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalContr… |
CVE-2026-95661 | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL… | |
CVE-2026-95659 | | 2026-09-22 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type… | |
CVE-2026-93836 | High | 7.2 | 2026-09-22 | The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and in… |
CVE-2026-93778 | High | 7.2 | 2026-09-22 | The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all v… |
CVE-2026-1645 | Medium | 4.4 | 2026-09-22 | The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions u… |
CVE-2026-16778 | Medium | 6.4 | 2026-09-22 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortco… |
CVE-2026-94504 | High | 7.2 | 2026-09-22 | Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break… |
CVE-2026-92438 | High | 8.8 | 2026-09-22 | The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whi… |
CVE-2026-89412 | High | 7.2 | 2026-09-22 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory… |
CVE-2026-93655 | Medium | 6.1 | 2026-09-22 | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and includi… |
CVE-2026-88788 | Medium | 6.8 | 2026-09-22 | The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block… |
CVE-2026-85653 | Medium | 6.4 | 2026-09-22 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, an… |
CVE-2026-94426 | Low | 3.5 | 2026-09-21 | A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of t… |
CVE-2026-59830 | Medium | 5.4 | 2026-09-21 | Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolati… |
CVE-2026-59814 | High | 7.6 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resou… |
CVE-2026-46650 | Medium | 4.4 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/… |
CVE-2026-88746 | High | 7.1 | 2026-09-21 | idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. |
CVE-2026-88745 | Medium | 6.1 | 2026-09-21 | EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. |
CVE-2026-55105 | High | 7.7 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml… |
CVE-2026-79320 | Medium | 6.1 | 2026-09-21 | Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimen… |
CVE-2026-73546 | High | 7.4 | 2026-09-21 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html… |
CVE-2026-49995 | | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is in… | |
CVE-2026-45381 | | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query paramete… | |
CVE-2026-91165 | Low | 2.4 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/… |
CVE-2026-58491 | Critical | 9.3 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attack… |
CVE-2026-94488 | High | 8.2 | 2026-09-21 | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_ht… |
CVE-2026-58504 | Medium | 6.1 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-… |
CVE-2026-36472 | Medium | 5.2 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrar… |
CVE-2026-36470 | Medium | 5.8 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unesca… |
CVE-2026-36468 | Medium | 6.1 | 2026-09-21 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part… |
CVE-2026-93339 | Medium | 5.4 | 2026-09-21 | Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-lev… |
CVE-2026-94387 | Medium | 5.4 | 2026-09-21 | Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered… |
CVE-2025-71419 | Medium | 5.4 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMail… |
CVE-2026-94373 | | 2026-09-21 | MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option… | |
CVE-2026-94372 | | 2026-09-21 | MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or defa… | |
CVE-2026-94211 | Low | 2.4 | 2026-09-21 | A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/… |
CVE-2026-94210 | Low | 3.5 | 2026-09-21 | A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Ticke… |
CVE-2026-94277 | | 2026-09-21 | MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any H… | |
CVE-2026-91921 | | 2026-09-21 | Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unaut… | |
CVE-2026-94150 | Low | 2.4 | 2026-09-21 | A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the compon… |
CVE-2026-94145 | Low | 3.5 | 2026-09-21 | A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/jo… |
CVE-2026-94045 | Low | 3.5 | 2026-09-20 | A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java… |
CVE-2026-94035 | Medium | 4.3 | 2026-09-20 | A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Execu… |
CVE-2026-94034 | Low | 3.5 | 2026-09-20 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/chan… |
CVE-2026-94033 | Low | 3.5 | 2026-09-20 | A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/ad… |
CVE-2026-94016 | Low | 2.4 | 2026-09-20 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_… |
CVE-2026-93977 | Low | 3.5 | 2026-09-20 | A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-… |
CVE-2026-93976 | Low | 2.4 | 2026-09-20 | A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the a… |
CVE-2026-93975 | Low | 2.4 | 2026-09-20 | A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component Us… |
CVE-2026-84223 | Medium | 6.8 | 2026-09-20 | The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access a… |
CVE-2026-14844 | Medium | 6.8 | 2026-09-20 | The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script con… |
CVE-2026-93956 | Low | 3.5 | 2026-09-19 | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php… |
CVE-2026-93981 | Medium | 4.7 | 2026-09-19 | hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an… |
CVE-2026-8354 | Medium | 6.4 | 2026-09-19 | The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including… |
CVE-2026-76579 | Medium | 4.7 | 2026-09-19 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due… |
CVE-2026-5410 | Medium | 6.4 | 2026-09-19 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is du… |
CVE-2026-1256 | Medium | 6.4 | 2026-09-19 | The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, an… |
CVE-2026-87917 | Medium | 6.1 | 2026-09-19 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, a… |
CVE-2026-5400 | Medium | 6.4 | 2026-09-19 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.1… |
CVE-2026-2422 | Medium | 6.4 | 2026-09-19 | The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all vers… |
CVE-2026-15664 | High | 7.2 | 2026-09-19 | The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Oth… |
CVE-2026-15463 | Medium | 6.1 | 2026-09-19 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all… |
CVE-2026-15098 | Medium | 6.4 | 2026-09-19 | The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized at… |
CVE-2026-13770 | Medium | 6.4 | 2026-09-19 | The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-12402 | Medium | 4.4 | 2026-09-19 | The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and inclu… |
CVE-2026-11608 | Medium | 6.1 | 2026-09-19 | The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and includi… |
CVE-2026-88824 | High | 8.8 | 2026-09-19 | The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings… |
CVE-2026-85680 | High | 8.8 | 2026-09-19 | The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, an… |
CVE-2026-76790 | High | 7.1 | 2026-09-19 | The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting the… |
CVE-2025-15698 | Low | 3.5 | 2026-09-19 | The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |