CWE-79 · Cross-site Scripting (page 82)
Page 82 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12118 | Medium | 6.4 | 2025-11-01 | The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insu… |
CVE-2025-11995 | High | 7.2 | 2025-11-01 | The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2… |
CVE-2025-11927 | Medium | 4.4 | 2025-11-01 | The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in… |
CVE-2025-11928 | Medium | 4.4 | 2025-11-01 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5… |
CVE-2025-11922 | Medium | 6.4 | 2025-11-01 | The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up… |
CVE-2025-62618 | High | 8.0 | 2025-10-31 | ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because E… |
CVE-2025-62267 | Medium | 6.1 | 2025-10-31 | Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay D… |
CVE-2025-12546 | Low | 3.5 | 2025-10-31 | A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulatio… |
CVE-2025-62264 | Medium | 6.1 | 2025-10-31 | Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2025-61427 | Medium | 6.1 | 2025-10-31 | A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in the context of a u… |
CVE-2025-12460 | | 2025-10-31 | An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript… | |
CVE-2024-13992 | Medium | 5.4 | 2025-10-31 | Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link fr… |
CVE-2025-64367 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Stored XSS.This… |
CVE-2025-64365 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This… |
CVE-2025-64362 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.T… |
CVE-2025-64361 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-el… |
CVE-2025-64354 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matias Ventura Gutenberg gutenberg allows Stored XSS.This… |
CVE-2025-11806 | Medium | 6.4 | 2025-10-31 | The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This… |
CVE-2025-27208 | Medium | 6.1 | 2025-10-31 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the us… |
CVE-2025-34278 | Medium | 5.4 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator men… |
CVE-2024-14001 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or esca… |
CVE-2024-14000 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or esca… |
CVE-2024-13993 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Ins… |
CVE-2023-7323 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of us… |
CVE-2023-7321 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was not safely encoded fo… |
CVE-2023-7319 | Medium | 5.4 | 2025-10-30 | Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficient validation or es… |
CVE-2023-7318 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or es… |
CVE-2023-7316 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-s… |
CVE-2023-7315 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-s… |
CVE-2023-7314 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user… |
CVE-2023-7313 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-su… |
CVE-2023-7312 | Medium | 4.8 | 2025-10-30 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user inp… |
CVE-2023-53690 | Medium | 4.8 | 2025-10-30 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized… |
CVE-2023-53689 | Medium | 4.8 | 2025-10-30 | Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in exe… |
CVE-2023-53688 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An att… |
CVE-2022-50588 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supp… |
CVE-2022-50587 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text. Insufficient validation or escaping of u… |
CVE-2022-50586 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping… |
CVE-2022-50585 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log… |
CVE-2022-50584 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and… |
CVE-2021-47699 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping o… |
CVE-2021-47697 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-… |
CVE-2021-47696 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling. Insufficient validation or escaping of user-supplied… |
CVE-2021-47695 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-suppli… |
CVE-2021-47694 | Medium | 6.1 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the… |
CVE-2021-47691 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the S… |
CVE-2021-47690 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overla… |
CVE-2021-47689 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pa… |
CVE-2020-36866 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or esc… |
CVE-2020-36865 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Ed… |
CVE-2020-36864 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or esca… |
CVE-2020-36862 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject scr… |
CVE-2020-36861 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the ov… |
CVE-2020-36860 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the ob… |
CVE-2020-36858 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Ho… |
CVE-2018-25121 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of… |
CVE-2018-25119 | Medium | 6.1 | 2025-10-30 | Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of use… |
CVE-2017-20209 | Medium | 6.1 | 2025-10-30 | Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user… |
CVE-2016-15053 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or es… |
CVE-2016-15052 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface. Insufficient validation or escaping of… |
CVE-2016-15051 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields… |
CVE-2016-15049 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table… |
CVE-2013-10074 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping… |
CVE-2013-10071 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficien… |
CVE-2011-10040 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient… |
CVE-2011-10039 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interfac… |
CVE-2011-10038 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validati… |
CVE-2011-10037 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web in… |
CVE-2011-10036 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validatio… |
CVE-2025-62265 | Medium | 5.4 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4… |
CVE-2025-52180 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript vi… |
CVE-2025-52179 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2025-64112 | High | 8.0 | 2025-10-30 | Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with… |
CVE-2025-56313 | Medium | 6.1 | 2025-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote at… |
CVE-2025-63885 | Medium | 6.1 | 2025-10-30 | A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-60950 | Medium | 6.1 | 2025-10-30 | An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG… |
CVE-2025-36592 | Medium | 5.4 | 2025-10-30 | Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Gener… |
CVE-2025-5347 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. |
CVE-2025-5343 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. |
CVE-2025-50574 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary… |
CVE-2025-10348 | | 2025-10-30 | URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a ma… | |
CVE-2025-39663 | High | 8.4 | 2025-10-30 | Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service output… |
CVE-2025-12475 | Medium | 6.4 | 2025-10-30 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versio… |
CVE-2025-12083 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripti… |
CVE-2025-10931 | Low | 3.8 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS)… |
CVE-2025-10927 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XS… |
CVE-2025-10926 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This… |
CVE-2025-54384 | Medium | 6.3 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() functio… |
CVE-2025-12450 | Medium | 6.1 | 2025-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insuffic… |
CVE-2025-64291 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allow… |
CVE-2025-64289 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premme… |
CVE-2025-64220 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issu… |
CVE-2025-64208 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-… |
CVE-2025-64204 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This iss… |
CVE-2025-64202 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue aff… |
CVE-2025-64200 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2025-64197 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affe… |
CVE-2025-64194 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affect… |
CVE-2025-49042 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This… |
CVE-2025-64094 | Medium | 6.4 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of… |