CWE-79 · Cross-site Scripting (page 8)
Page 8 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65519 | Medium | 6.5 | 2026-07-23 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. |
CVE-2026-65518 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. |
CVE-2026-65514 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. |
CVE-2026-65511 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
CVE-2026-65510 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-65503 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-65492 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions. |
CVE-2026-65483 | Medium | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions. |
CVE-2026-65482 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions. |
CVE-2026-65480 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affe… |
CVE-2026-65475 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This is… |
CVE-2026-65473 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions. |
CVE-2026-65470 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. |
CVE-2026-65465 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions. |
CVE-2026-65449 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. |
CVE-2026-64810 | Medium | 4.3 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking |
CVE-2026-61947 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. |
CVE-2026-61944 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions. |
CVE-2026-59517 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions. |
CVE-2026-59513 | Medium | 6.5 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. |
CVE-2026-59512 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions. |
CVE-2026-57809 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions. |
CVE-2026-57769 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions. |
CVE-2026-57767 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions. |
CVE-2026-57735 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions. |
CVE-2026-57704 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. |
CVE-2026-57701 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. |
CVE-2026-57699 | High | 7.1 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. |
CVE-2026-57428 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. |
CVE-2026-57427 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. |
CVE-2026-57397 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. |
CVE-2026-57384 | Medium | 6.5 | 2026-07-23 | Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. |
CVE-2026-57374 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. |
CVE-2026-57373 | Medium | 6.5 | 2026-07-23 | Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. |
CVE-2026-57370 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. |
CVE-2026-27403 | Medium | 6.5 | 2026-07-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affe… |
CVE-2026-24628 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
CVE-2025-68081 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. |
CVE-2026-65756 | Medium | 6.1 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. |
CVE-2026-15794 | Medium | 6.4 | 2026-07-23 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to… |
CVE-2026-15647 | Medium | 4.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and… |
CVE-2026-15646 | Medium | 6.4 | 2026-07-23 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-15404 | Medium | 6.4 | 2026-07-23 | The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insuffici… |
CVE-2026-15394 | Medium | 6.4 | 2026-07-23 | The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet… |
CVE-2026-14481 | Medium | 6.4 | 2026-07-23 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-9729 | Medium | 6.4 | 2026-07-23 | The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notificat… |
CVE-2026-9635 | Medium | 6.4 | 2026-07-23 | The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions… |
CVE-2026-12421 | High | 7.2 | 2026-07-23 | The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to in… |
CVE-2026-9577 | Medium | 4.8 | 2026-07-23 | The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page… |
CVE-2026-9066 | Medium | 6.1 | 2026-07-23 | The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the… |
CVE-2026-7534 | High | 7.2 | 2026-07-23 | The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning`… |
CVE-2026-7232 | High | 7.2 | 2026-07-23 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9… |
CVE-2026-64795 | Medium | 5.4 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title ove… |
CVE-2026-63281 | Medium | 4.8 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in admin… |
CVE-2026-64828 | Medium | 6.1 | 2026-07-22 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaS… |
CVE-2026-8152 | | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with… | |
CVE-2026-65597 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution… |
CVE-2026-65592 | Medium | 5.4 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-p… |
CVE-2026-63264 | | 2026-07-22 | Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerabilit… | |
CVE-2026-15787 | Medium | 6.4 | 2026-07-22 | The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon… |
CVE-2026-12968 | High | 8.8 | 2026-07-22 | The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts… |
CVE-2026-16486 | Medium | 4.3 | 2026-07-21 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulatio… |
CVE-2026-16485 | Medium | 4.3 | 2026-07-21 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class… |
CVE-2026-60664 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60650 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60646 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60639 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60638 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60637 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60636 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60635 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60634 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60633 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-52475 | Medium | 6.1 | 2026-07-21 | Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file |
CVE-2026-47689 | Medium | 4.6 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method… |
CVE-2026-47687 | High | 7.3 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helpe… |
CVE-2026-47685 | High | 7.3 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inve… |
CVE-2026-50758 | High | 8.1 | 2026-07-21 | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter |
CVE-2026-55081 | | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values… | |
CVE-2026-64823 | Medium | 4.7 | 2026-07-21 | Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attack… |
CVE-2026-28315 | Medium | 6.2 | 2026-07-21 | SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from a… |
CVE-2026-65048 | Critical | 9.3 | 2026-07-21 | Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldse… |
CVE-2026-64628 | Medium | 5.4 | 2026-07-21 | Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing li… |
CVE-2026-15145 | Medium | 6.4 | 2026-07-21 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Wid… |
CVE-2026-11767 | High | 8.8 | 2026-07-21 | The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in… |
CVE-2026-15782 | Medium | 4.9 | 2026-07-21 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Sc… |
CVE-2026-15156 | Medium | 6.4 | 2026-07-21 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progre… |
CVE-2023-37508 | Medium | 6.1 | 2026-07-21 | HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknes… |
CVE-2026-51025 | Medium | 6.1 | 2026-07-20 | Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.j… |
CVE-2026-12900 | Medium | 6.4 | 2026-07-20 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` bloc… |
CVE-2026-44230 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6… |
CVE-2026-44229 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Sit… |
CVE-2026-60034 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerabil… | |
CVE-2026-60029 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an auth… | |
CVE-2026-60028 | | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an auth… | |
CVE-2026-44228 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS)… |
CVE-2026-44227 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS… |
CVE-2026-39878 | Critical | 9.3 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated atta… |
CVE-2026-26483 | Medium | 6.1 | 2026-07-20 | Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails… |
CVE-2026-6793 | Medium | 5.4 | 2026-07-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allow… |