CWE-79 · Cross-site Scripting (page 80)
Page 80 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11994 | High | 7.2 | 2025-11-12 | The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1… |
CVE-2025-61623 | Medium | 6.5 | 2025-11-12 | Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 2… |
CVE-2025-11962 | High | 7.3 | 2025-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital C… |
CVE-2025-12872 | Medium | 5.4 | 2025-11-12 | The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing ma… |
CVE-2025-12869 | Medium | 4.8 | 2025-11-12 | The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent Ja… |
CVE-2025-12018 | Medium | 4.4 | 2025-11-12 | The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to… |
CVE-2025-62211 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-62210 | High | 8.7 | 2025-11-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to pe… |
CVE-2025-9227 | Medium | 6.5 | 2025-11-11 | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. |
CVE-2025-12101 | | 2025-11-11 | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy… | |
CVE-2025-41106 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41105 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41104 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41103 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41102 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-41101 | Medium | 5.4 | 2025-11-11 | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user… |
CVE-2025-11960 | Medium | 6.1 | 2025-11-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET… |
CVE-2025-7633 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. |
CVE-2025-7632 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. |
CVE-2025-7430 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. |
CVE-2025-7429 | High | 7.3 | 2025-11-11 | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. |
CVE-2025-12880 | Medium | 5.4 | 2025-11-11 | The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2025-12754 | Medium | 6.4 | 2025-11-11 | The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and… |
CVE-2025-12711 | Medium | 6.4 | 2025-11-11 | The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and in… |
CVE-2025-12672 | Medium | 6.4 | 2025-11-11 | The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions… |
CVE-2025-12671 | Medium | 6.4 | 2025-11-11 | The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, a… |
CVE-2025-12668 | Medium | 6.4 | 2025-11-11 | The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all… |
CVE-2025-12667 | Medium | 6.4 | 2025-11-11 | The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up t… |
CVE-2025-12663 | Medium | 6.4 | 2025-11-11 | The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions… |
CVE-2025-12662 | Medium | 6.4 | 2025-11-11 | The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to… |
CVE-2025-12658 | Medium | 6.4 | 2025-11-11 | The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortco… |
CVE-2025-12652 | Medium | 6.4 | 2025-11-11 | The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all… |
CVE-2025-12651 | Medium | 6.4 | 2025-11-11 | The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the li… |
CVE-2025-12644 | Medium | 6.4 | 2025-11-11 | The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode i… |
CVE-2025-12632 | Medium | 5.5 | 2025-11-11 | The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insuffi… |
CVE-2025-12631 | Medium | 4.4 | 2025-11-11 | The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 d… |
CVE-2025-12538 | Medium | 4.4 | 2025-11-11 | The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insuf… |
CVE-2025-12021 | Medium | 6.1 | 2025-11-11 | The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0… |
CVE-2025-12020 | Medium | 4.9 | 2025-11-11 | The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin… |
CVE-2025-12019 | Medium | 4.4 | 2025-11-11 | The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insuff… |
CVE-2025-11882 | Medium | 6.4 | 2025-11-11 | The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to… |
CVE-2025-11873 | Medium | 6.4 | 2025-11-11 | The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 du… |
CVE-2025-11869 | Medium | 6.4 | 2025-11-11 | The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and includin… |
CVE-2025-11863 | Medium | 6.4 | 2025-11-11 | The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeo_city' shortcode in all versions up to, and including, 1… |
CVE-2025-11860 | Medium | 6.4 | 2025-11-11 | The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3… |
CVE-2025-11859 | Medium | 6.4 | 2025-11-11 | The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including… |
CVE-2025-11856 | Medium | 6.4 | 2025-11-11 | The Eventbee Ticketing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventbeeticketwidget' shortcode in all versions up to… |
CVE-2025-11829 | Medium | 6.4 | 2025-11-11 | The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the [five9-chat] shortcode in all versions… |
CVE-2025-11828 | Medium | 6.4 | 2025-11-11 | The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 b… |
CVE-2025-11822 | Medium | 6.4 | 2025-11-11 | The WP Bootstrap Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bootstrap_tab' shortcode in all versions up to, and including… |
CVE-2025-11821 | Medium | 6.4 | 2025-11-11 | The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all v… |
CVE-2025-11805 | Medium | 6.4 | 2025-11-11 | The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4… |
CVE-2025-11129 | Medium | 6.4 | 2025-11-11 | The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'type' parameters in all versions up to, an… |
CVE-2025-42886 | Medium | 6.1 | 2025-11-11 | Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it… |
CVE-2025-11892 | Critical | 9.6 | 2025-11-10 | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label… |
CVE-2025-64501 | High | 7.6 | 2025-11-10 | ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is v… |
CVE-2025-64167 | High | 7.1 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execu… |
CVE-2025-62780 | Low | 3.5 | 2025-11-10 | changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in ver… |
CVE-2025-48065 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error co… |
CVE-2025-48055 | High | 8.5 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site… |
CVE-2025-47932 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered… |
CVE-2025-47773 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited vi… |
CVE-2025-63834 | Medium | 5.4 | 2025-11-10 | A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wirele… |
CVE-2025-63709 | Medium | 5.4 | 2025-11-10 | A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submi… |
CVE-2025-41001 | Medium | 5.4 | 2025-11-10 | Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sendi… |
CVE-2025-41107 | Medium | 5.4 | 2025-11-10 | Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admi… |
CVE-2025-12920 | Low | 2.4 | 2025-11-09 | A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi… |
CVE-2025-12837 | Medium | 6.4 | 2025-11-08 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and includi… |
CVE-2025-12643 | Medium | 6.4 | 2025-11-08 | The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and i… |
CVE-2025-12193 | Medium | 6.1 | 2025-11-08 | The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter in all versions up to, and including, 2.3.1 due t… |
CVE-2025-12125 | Medium | 4.4 | 2025-11-08 | The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2025-12112 | Medium | 6.4 | 2025-11-08 | The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and… |
CVE-2025-12064 | Medium | 6.1 | 2025-11-08 | The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due… |
CVE-2025-64495 | High | 8.7 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts… |
CVE-2025-64491 | Medium | 6.1 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated refle… |
CVE-2025-63420 | Medium | 4.1 | 2025-11-07 | CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execu… |
CVE-2025-64442 | Medium | 6.1 | 2025-11-07 | HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to b… |
CVE-2025-63544 | Medium | 6.1 | 2025-11-07 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter. |
CVE-2025-63543 | Medium | 6.1 | 2025-11-07 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter. |
CVE-2025-63640 | Medium | 6.1 | 2025-11-07 | Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Up… |
CVE-2025-63639 | Medium | 6.1 | 2025-11-07 | The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-… |
CVE-2025-63638 | Medium | 6.1 | 2025-11-07 | Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating… |
CVE-2025-61261 | Medium | 5.4 | 2025-11-07 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user'… |
CVE-2025-36135 | Medium | 5.4 | 2025-11-07 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 th… |
CVE-2025-63714 | Medium | 6.1 | 2025-11-07 | Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the conte… |
CVE-2025-63713 | Medium | 6.1 | 2025-11-07 | Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input i… |
CVE-2025-63785 | Medium | 6.1 | 2025-11-07 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because… |
CVE-2025-58465 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the v… |
CVE-2025-57706 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vul… |
CVE-2025-54168 | Medium | 4.8 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-54167 | | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then… | |
CVE-2025-64339 | Medium | 5.4 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scrip… |
CVE-2025-12520 | Medium | 4.0 | 2025-11-07 | The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due… |
CVE-2025-64338 | Critical | 9.0 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose C… |
CVE-2025-64336 | Medium | 5.4 | 2025-11-07 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scriptin… |
CVE-2025-52662 | Medium | 6.9 | 2025-11-07 | A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurati… |
CVE-2025-64302 | Medium | 6.4 | 2025-11-06 | Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipul… |
CVE-2025-64177 | Medium | 5.4 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (X… |
CVE-2025-64176 | Medium | 5.3 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish… |
CVE-2025-64174 | Medium | 4.8 | 2025-11-06 | Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS… |