CWE-79 · Cross-site Scripting (page 90)
Page 90 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48700 | Medium | 6.1 | 2025-06-23 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI all… |
CVE-2025-6477 | Low | 2.4 | 2025-06-22 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2025-6475 | Low | 2.4 | 2025-06-22 | A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2025-6473 | Medium | 4.3 | 2025-06-22 | A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /fees… |
CVE-2025-6452 | Low | 2.4 | 2025-06-22 | A vulnerability was found in CodeAstro Patient Record Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of th… |
CVE-2025-1987 | Medium | 6.1 | 2025-06-21 | A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bi… |
CVE-2025-5289 | Medium | 6.4 | 2025-06-21 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ a… |
CVE-2025-5143 | Medium | 6.4 | 2025-06-21 | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button s… |
CVE-2025-5034 | High | 7.1 | 2025-06-21 | The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2025-52552 | Medium | 6.1 | 2025-06-21 | FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Impr… |
CVE-2025-52486 | Medium | 6.1 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-52485 | Medium | 5.4 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-2443 | High | 8.7 | 2025-06-20 | An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific con… |
CVE-2025-6353 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic was found in code-projects Responsive Blog 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-6347 | Low | 2.4 | 2025-06-20 | A vulnerability was found in code-projects Responsive Blog 1.0/1.12.4/3.3.4. It has been declared as problematic. This vulnerability affects unknown code of th… |
CVE-2025-6345 | Low | 3.5 | 2025-06-20 | A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addRecipeModal of the file… |
CVE-2025-52782 | High | 7.1 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in King Rayhan Scroll UP scroll-to-up allows Reflected XSS.T… |
CVE-2025-52733 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embe… |
CVE-2025-52710 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.Th… |
CVE-2025-52707 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored… |
CVE-2025-50051 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This… |
CVE-2025-50050 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings… |
CVE-2025-50049 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows… |
CVE-2025-50048 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu aut… |
CVE-2025-50047 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue af… |
CVE-2025-50046 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This is… |
CVE-2025-50045 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce rel… |
CVE-2025-50043 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Code Engine code-engine allows Stored XSS.This… |
CVE-2025-50042 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-regi… |
CVE-2025-50041 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Engine Gutenberg Blocks – ACF Blocks Suite acf-blocks… |
CVE-2025-50038 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-e… |
CVE-2025-50037 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm al… |
CVE-2025-50035 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XS… |
CVE-2025-50033 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Base… |
CVE-2025-50030 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose all… |
CVE-2025-50027 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows S… |
CVE-2025-50026 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spoki Spoki spoki allows Stored XSS.This issue affects Sp… |
CVE-2025-50025 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue… |
CVE-2025-50024 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS… |
CVE-2025-50023 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allo… |
CVE-2025-50022 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JK WP-FB-AutoConnect wp-fb-autoconnect allows Stored XSS… |
CVE-2025-50021 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect better-random-redirec… |
CVE-2025-50020 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitin Yawalkar RDFa Breadcrumb rdfa-breadcrumb allows Sto… |
CVE-2025-50019 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer… |
CVE-2025-50018 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affe… |
CVE-2025-50017 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XS… |
CVE-2025-50016 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XS… |
CVE-2025-50015 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This… |
CVE-2025-50014 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows S… |
CVE-2025-50013 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved a… |
CVE-2025-50012 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows… |
CVE-2025-50011 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. T… |
CVE-2025-49873 | High | 7.1 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This i… |
CVE-2025-6340 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /branch.php… |
CVE-2025-6257 | Medium | 6.4 | 2025-06-20 | The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to… |
CVE-2025-5125 | Medium | 4.8 | 2025-06-20 | The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without saniti… |
CVE-2025-6301 | Low | 2.4 | 2025-06-20 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-6288 | Low | 2.4 | 2025-06-20 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2025-6287 | Low | 3.5 | 2025-06-20 | A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-6285 | Medium | 4.3 | 2025-06-19 | A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unknown processing of… |
CVE-2025-6268 | Medium | 4.3 | 2025-06-19 | A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search… |
CVE-2025-5234 | Medium | 6.4 | 2025-06-19 | The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4… |
CVE-2025-4965 | Medium | 6.4 | 2025-06-19 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions… |
CVE-2025-5490 | Medium | 5.5 | 2025-06-19 | The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insu… |
CVE-2025-5524 | Medium | 4.9 | 2025-06-19 | The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insuffi… |
CVE-2025-4479 | Medium | 6.4 | 2025-06-19 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's befor… |
CVE-2025-6201 | Medium | 6.4 | 2025-06-19 | The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-50183 | Medium | 6.5 | 2025-06-19 | OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application… |
CVE-2025-23169 | Medium | 6.1 | 2025-06-19 | The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provide… |
CVE-2025-1349 | Medium | 5.5 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. T… |
CVE-2024-54183 | Medium | 5.4 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulne… |
CVE-2025-45786 | High | 8.1 | 2025-06-18 | Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php. |
CVE-2025-45661 | Medium | 5.9 | 2025-06-18 | A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload int… |
CVE-2025-5237 | Medium | 6.4 | 2025-06-18 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including… |
CVE-2025-4955 | Medium | 4.7 | 2025-06-18 | The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could al… |
CVE-2025-49149 | Medium | 6.1 | 2025-06-17 | Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use web… |
CVE-2025-45880 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in t… |
CVE-2025-45878 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-45879 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-49882 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XS… |
CVE-2025-49881 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-49878 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.T… |
CVE-2025-49875 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-49871 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows… |
CVE-2025-49863 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored… |
CVE-2025-49862 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This… |
CVE-2025-49861 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows… |
CVE-2025-49859 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This… |
CVE-2025-49858 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2025-49855 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes al… |
CVE-2025-49316 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflect… |
CVE-2025-49312 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for Wo… |
CVE-2025-49266 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Refle… |
CVE-2025-48333 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows… |
CVE-2025-48145 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-ta… |
CVE-2025-39508 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This i… |
CVE-2025-30988 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player all… |
CVE-2025-5700 | Medium | 6.4 | 2025-06-17 | The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 d… |
CVE-2025-5291 | Medium | 6.4 | 2025-06-17 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide sho… |
CVE-2025-6050 | Medium | 4.8 | 2025-06-17 | Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "… |