CWE-79 · Cross-site Scripting (page 95)
Page 95 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27334 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ángel C. Simple Google Static Map simple-google-static-ma… |
CVE-2023-26001 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. T… |
CVE-2023-26000 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue aff… |
CVE-2025-5239 | Medium | 6.4 | 2025-06-06 | The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0… |
CVE-2025-49076 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2025-49075 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issu… |
CVE-2025-49074 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor al… |
CVE-2025-49068 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This is… |
CVE-2025-49067 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Stored XSS.This issu… |
CVE-2025-48329 | High | 7.1 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-ti… |
CVE-2025-41367 | | 2025-06-06 | Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaSc… | |
CVE-2025-41364 | | 2025-06-06 | Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaSc… | |
CVE-2025-5757 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Traffic Offense Reporting System 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-5727 | Low | 2.4 | 2025-06-06 | A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /scri… |
CVE-2025-5703 | Medium | 6.4 | 2025-06-06 | The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to… |
CVE-2025-5699 | Medium | 5.5 | 2025-06-06 | The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 d… |
CVE-2025-5586 | Medium | 6.4 | 2025-06-06 | The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to… |
CVE-2025-5565 | Medium | 6.4 | 2025-06-06 | The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 d… |
CVE-2025-5541 | Medium | 6.4 | 2025-06-06 | The Runners Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode in all versions up to, and including… |
CVE-2025-5538 | Medium | 6.4 | 2025-06-06 | The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and inclu… |
CVE-2025-5536 | Medium | 6.4 | 2025-06-06 | The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and includin… |
CVE-2025-5534 | Medium | 6.4 | 2025-06-06 | The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to… |
CVE-2025-5533 | Medium | 6.4 | 2025-06-06 | The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including… |
CVE-2025-5726 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown func… |
CVE-2025-5725 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2025-5724 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2025-5723 | Low | 2.4 | 2025-06-06 | A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2025-5722 | Low | 2.4 | 2025-06-06 | A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2025-5721 | Low | 2.4 | 2025-06-06 | A vulnerability, which was classified as problematic, was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the fil… |
CVE-2025-5713 | Low | 3.5 | 2025-06-06 | A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2025-5661 | Low | 2.4 | 2025-06-05 | A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file… |
CVE-2025-30084 | Medium | 6.1 | 2025-06-05 | A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-suppl… |
CVE-2025-27754 | Medium | 6.5 | 2025-06-05 | A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious Jav… |
CVE-2025-5341 | Medium | 6.4 | 2025-06-05 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'dat… |
CVE-2025-5651 | Low | 3.5 | 2025-06-05 | A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown pro… |
CVE-2025-5628 | Low | 3.5 | 2025-06-05 | A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functional… |
CVE-2025-32015 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cro… |
CVE-2025-31136 | Medium | 6.7 | 2025-06-04 | FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a… |
CVE-2025-22245 | Medium | 5.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. |
CVE-2025-22244 | Medium | 6.9 | 2025-06-04 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. |
CVE-2025-22243 | High | 7.5 | 2025-06-04 | VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. |
CVE-2025-20279 | Medium | 4.8 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an a… |
CVE-2025-20273 | Medium | 6.1 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacke… |
CVE-2025-29094 | Medium | 6.1 | 2025-06-04 | Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Mar… |
CVE-2025-5584 | Low | 2.4 | 2025-06-04 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown function of the file /doc… |
CVE-2025-27444 | Medium | 4.8 | 2025-06-04 | A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateF… |
CVE-2025-5539 | Medium | 6.4 | 2025-06-04 | The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta'… |
CVE-2025-5532 | Medium | 6.4 | 2025-06-04 | The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2025-5531 | Medium | 6.4 | 2025-06-04 | The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2025-5543 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been declared as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2025-5542 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been classified as problematic. Affected is an unknown function of the file /boafrm/f… |
CVE-2025-5523 | Low | 3.5 | 2025-06-03 | A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enil… |
CVE-2025-5516 | Low | 2.4 | 2025-06-03 | A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formF… |
CVE-2025-5513 | Low | 3.5 | 2025-06-03 | A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-5508 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2025-5507 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2025-44148 | Critical | 9.8 | 2025-06-03 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component |
CVE-2025-5506 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT… |
CVE-2025-5505 | Low | 2.4 | 2025-06-03 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafr… |
CVE-2025-43924 | Medium | 6.1 | 2025-06-03 | Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and th… |
CVE-2025-5340 | Medium | 6.4 | 2025-06-03 | The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and i… |
CVE-2025-4671 | Medium | 6.4 | 2025-06-03 | The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to… |
CVE-2025-4205 | Medium | 6.4 | 2025-06-03 | The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due… |
CVE-2025-4392 | High | 7.2 | 2025-06-03 | The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in a… |
CVE-2025-5116 | Medium | 6.4 | 2025-06-03 | The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerid’ parameter in all versions up to, and including… |
CVE-2025-4420 | Medium | 6.4 | 2025-06-03 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ param… |
CVE-2025-4567 | Medium | 4.8 | 2025-06-03 | The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options b… |
CVE-2025-3662 | Medium | 6.1 | 2025-06-03 | The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issu… |
CVE-2025-3584 | Medium | 4.8 | 2025-06-03 | The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as ad… |
CVE-2025-4224 | High | 7.2 | 2025-06-03 | The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and in… |
CVE-2025-3919 | Medium | 6.4 | 2025-06-02 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_se… |
CVE-2025-45387 | Medium | 5.4 | 2025-06-02 | osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. |
CVE-2025-20297 | Medium | 4.3 | 2025-06-02 | In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privile… |
CVE-2024-8008 | Medium | 5.2 | 2025-06-02 | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JD… |
CVE-2024-3509 | Medium | 4.3 | 2025-06-02 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich T… |
CVE-2025-44115 | Medium | 5.4 | 2025-06-02 | A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation… |
CVE-2024-40114 | Medium | 6.1 | 2025-06-02 | A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language coo… |
CVE-2024-57783 | High | 8.1 | 2025-06-02 | The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTM… |
CVE-2025-48958 | Medium | 5.5 | 2025-06-02 | Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacke… |
CVE-2025-48495 | Medium | 5.4 | 2025-06-02 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated use… |
CVE-2025-48494 | Medium | 5.4 | 2025-06-02 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting v… |
CVE-2025-47289 | Medium | 6.3 | 2025-06-02 | CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1… |
CVE-2025-1485 | Medium | 4.8 | 2025-06-02 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise an… |
CVE-2025-5420 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-c… |
CVE-2025-5412 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.p… |
CVE-2025-5411 | Low | 3.5 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been rated as problematic. This issue affects the function tag_resources of the file sr… |
CVE-2025-5407 | Low | 2.4 | 2025-06-01 | A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affected by this vulnera… |
CVE-2025-5405 | Low | 3.5 | 2025-06-01 | A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affec… |
CVE-2025-2896 | Medium | 4.8 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-25044 | Medium | 5.4 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-5383 | Low | 2.4 | 2025-05-31 | A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Articl… |
CVE-2025-5378 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycouncil2.aspx. The m… |
CVE-2025-5377 | Medium | 4.3 | 2025-05-31 | A vulnerability was found in Astun Technology iShare Maps 5.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-5290 | Medium | 6.4 | 2025-05-31 | The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up… |
CVE-2025-3813 | Medium | 6.4 | 2025-05-31 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions… |
CVE-2025-5292 | Medium | 6.4 | 2025-05-31 | The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable… |
CVE-2025-5285 | Medium | 6.4 | 2025-05-31 | The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and i… |
CVE-2025-4595 | Medium | 6.4 | 2025-05-31 | The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog'… |
CVE-2025-4590 | Medium | 6.4 | 2025-05-31 | The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisycon_uitvaart' shortcode in all versions… |
CVE-2025-5016 | Medium | 4.7 | 2025-05-31 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and includ… |