CWE-79 · Cross-site Scripting (page 88)
Page 88 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11289 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-11278 | Medium | 4.3 | 2025-10-05 | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulatio… |
CVE-2025-11276 | Low | 3.5 | 2025-10-05 | A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing… |
CVE-2025-9952 | Medium | 6.1 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '… |
CVE-2025-10383 | Medium | 6.4 | 2025-10-04 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field para… |
CVE-2025-9030 | Medium | 5.4 | 2025-10-04 | The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versio… |
CVE-2025-8726 | Medium | 5.4 | 2025-10-04 | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input s… |
CVE-2025-61681 | Medium | 5.4 | 2025-10-03 | KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exp… |
CVE-2025-53354 | Medium | 6.1 | 2025-10-03 | NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into t… |
CVE-2025-52653 | High | 7.6 | 2025-10-03 | HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentia… |
CVE-2021-42193 | Medium | 6.1 | 2025-10-03 | nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires. |
CVE-2025-60454 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, spec… |
CVE-2025-60453 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, spe… |
CVE-2025-60452 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, s… |
CVE-2025-60451 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60450 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60448 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file… |
CVE-2025-60447 | Medium | 5.9 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration compone… |
CVE-2025-60445 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SV… |
CVE-2025-9876 | Medium | 6.4 | 2025-10-03 | The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1… |
CVE-2025-9875 | Medium | 6.4 | 2025-10-03 | The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions u… |
CVE-2025-9859 | Medium | 6.4 | 2025-10-03 | The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all ver… |
CVE-2025-9858 | Medium | 6.4 | 2025-10-03 | The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions u… |
CVE-2025-9854 | Medium | 6.4 | 2025-10-03 | The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions… |
CVE-2025-9372 | Medium | 5.5 | 2025-10-03 | The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to ins… |
CVE-2025-9333 | Medium | 5.5 | 2025-10-03 | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insuffic… |
CVE-2025-9332 | Medium | 5.5 | 2025-10-03 | The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2025-9206 | Medium | 6.4 | 2025-10-03 | The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This… |
CVE-2025-9204 | Medium | 6.4 | 2025-10-03 | The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and includin… |
CVE-2025-9130 | Medium | 6.4 | 2025-10-03 | The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and… |
CVE-2025-9129 | Medium | 6.4 | 2025-10-03 | The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and… |
CVE-2025-9080 | Medium | 6.4 | 2025-10-03 | The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to… |
CVE-2025-9077 | Medium | 6.4 | 2025-10-03 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in ve… |
CVE-2025-9045 | Medium | 6.4 | 2025-10-03 | The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2… |
CVE-2025-8776 | Medium | 6.4 | 2025-10-03 | The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0… |
CVE-2025-10192 | Medium | 6.4 | 2025-10-03 | The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and incl… |
CVE-2025-10165 | Medium | 6.4 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and i… |
CVE-2025-10053 | Medium | 4.4 | 2025-10-03 | The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |
CVE-2025-0876 | Medium | 4.1 | 2025-10-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies T… |
CVE-2025-61599 | Medium | 5.4 | 2025-10-03 | Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below… |
CVE-2025-61597 | High | 7.6 | 2025-10-03 | Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail… |
CVE-2025-54089 | Low | 3.4 | 2025-10-02 | CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can int… |
CVE-2025-56154 | Medium | 6.1 | 2025-10-02 | htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitize… |
CVE-2025-61087 | Medium | 6.1 | 2025-10-02 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section. |
CVE-2025-60782 | Medium | 5.4 | 2025-10-02 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics… |
CVE-2025-59774 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59773 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59772 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59771 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59770 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59769 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59768 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59767 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59766 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59765 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59764 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59763 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59762 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59761 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59760 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59759 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59758 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59757 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59756 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59755 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59754 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59753 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59752 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59751 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59750 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59749 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59748 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59747 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59746 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-56379 | Medium | 5.4 | 2025-10-02 | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2025-40992 | | 2025-10-02 | Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affectin… | |
CVE-2025-40991 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40990 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40989 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-57389 | Medium | 5.4 | 2025-10-01 | A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Java… |
CVE-2025-57444 | Medium | 6.1 | 2025-10-01 | An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to… |
CVE-2025-60991 | High | 8.8 | 2025-10-01 | A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the contex… |
CVE-2025-57393 | High | 8.8 | 2025-10-01 | A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web… |
CVE-2024-57494 | Medium | 6.5 | 2025-10-01 | Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter. |
CVE-2025-34182 | | 2025-10-01 | In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-relat… | |
CVE-2025-20368 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-20367 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privile… |
CVE-2025-20361 | Medium | 4.8 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2025-20357 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-20356 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-56515 | High | 8.8 | 2025-10-01 | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowin… |
CVE-2025-56514 | Medium | 5.4 | 2025-10-01 | Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other us… |
CVE-2025-40648 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'nu… | |
CVE-2025-40647 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'em… | |
CVE-2025-9075 | Medium | 6.4 | 2025-10-01 | The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This i… |
CVE-2025-43826 | Medium | 5.4 | 2025-09-30 | Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Lif… |
CVE-2025-36132 | Medium | 5.4 | 2025-09-30 | IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated u… |
CVE-2025-56200 | Medium | 6.1 | 2025-09-30 | A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while… |