CWE-79 · Cross-site Scripting (page 97)
Page 97 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4379 | | 2025-05-23 | DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaSc… | |
CVE-2025-5096 | Medium | 6.4 | 2025-05-23 | The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', an… |
CVE-2025-4594 | Medium | 6.4 | 2025-05-23 | The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions u… |
CVE-2024-5962 | Medium | 6.1 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-sup… |
CVE-2024-7103 | Medium | 4.6 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation… |
CVE-2024-13958 | Medium | 4.8 | 2025-05-22 | Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13950 | Medium | 6.8 | 2025-05-22 | Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue… |
CVE-2025-48369 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XS… |
CVE-2025-48368 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS… |
CVE-2025-48366 | Medium | 5.4 | 2025-05-22 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability… |
CVE-2025-33138 | Medium | 5.4 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-4405 | Medium | 4.9 | 2025-05-22 | The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due… |
CVE-2025-4123 | High | 7.6 | 2025-05-22 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect u… |
CVE-2025-4133 | Medium | 5.4 | 2025-05-22 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which… |
CVE-2025-5062 | Medium | 6.1 | 2025-05-22 | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and includin… |
CVE-2025-45755 | Medium | 6.1 | 2025-05-21 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can… |
CVE-2025-2261 | | 2025-05-21 | Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of… | |
CVE-2024-57529 | Medium | 6.1 | 2025-05-21 | Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary code. |
CVE-2025-4415 | Medium | 4.8 | 2025-05-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This i… |
CVE-2025-45754 | Medium | 5.4 | 2025-05-21 | A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by cr… |
CVE-2025-20250 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20247 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-20246 | Medium | 6.1 | 2025-05-21 | A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerability is due to imp… |
CVE-2025-48206 | Medium | 6.1 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows XSS. |
CVE-2025-48203 | Medium | 6.4 | 2025-05-21 | The cs_seo extension through 9.2.0 for TYPO3 allows XSS. |
CVE-2025-1420 | | 2025-05-21 | Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cros… | |
CVE-2025-1419 | | 2025-05-21 | Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack… | |
CVE-2025-4611 | Medium | 6.4 | 2025-05-21 | The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs sh… |
CVE-2025-4221 | Medium | 6.4 | 2025-05-21 | The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and… |
CVE-2025-4219 | Medium | 6.4 | 2025-05-21 | The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due t… |
CVE-2025-4217 | Medium | 6.4 | 2025-05-21 | The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to… |
CVE-2025-3781 | Medium | 6.4 | 2025-05-21 | The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up… |
CVE-2025-3750 | Medium | 6.4 | 2025-05-21 | The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and includi… |
CVE-2025-5013 | Medium | 4.3 | 2025-05-21 | A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.h… |
CVE-2025-5011 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html o… |
CVE-2025-5010 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the… |
CVE-2025-5007 | Low | 3.5 | 2025-05-20 | A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file… |
CVE-2025-4996 | Low | 2.4 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some unknown processing of the component Ad… |
CVE-2025-47853 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible |
CVE-2025-47852 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible |
CVE-2025-47851 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible |
CVE-2025-41228 | Medium | 4.3 | 2025-05-20 | VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access t… |
CVE-2025-40633 | | 2025-05-20 | A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerability allows an authenticated attacker… | |
CVE-2025-4951 | Medium | 4.6 | 2025-05-20 | Editions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" field. Despite the appli… |
CVE-2024-5878 | Medium | 6.4 | 2025-05-20 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in vari… |
CVE-2025-2929 | High | 7.1 | 2025-05-20 | The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2025-47946 | Medium | 6.1 | 2025-05-19 | Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or usin… |
CVE-2025-39393 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management a… |
CVE-2025-39392 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS… |
CVE-2025-39372 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Ticket… |
CVE-2025-39365 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affe… |
CVE-2025-31027 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue a… |
CVE-2025-43839 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflecte… |
CVE-2025-43837 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected… |
CVE-2025-43836 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflect… |
CVE-2025-43832 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allow… |
CVE-2025-39446 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflecte… |
CVE-2025-39409 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Im… |
CVE-2025-39407 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issu… |
CVE-2025-43841 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider… |
CVE-2025-43834 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue af… |
CVE-2025-39450 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-39448 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-26997 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected… |
CVE-2025-46543 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-… |
CVE-2025-46263 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-po… |
CVE-2025-46262 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored X… |
CVE-2025-39369 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XS… |
CVE-2025-4939 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the… |
CVE-2025-32920 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-w… |
CVE-2025-23988 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This is… |
CVE-2025-23986 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks Tiki Time allows Reflected XSS.This issue affec… |
CVE-2025-23983 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tijaji Tijaji tijaji allows Reflected XSS.This issue affe… |
CVE-2025-23981 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue aff… |
CVE-2025-23979 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Fl… |
CVE-2025-22792 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects… |
CVE-2025-22791 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twh offset writing allows Reflected XSS.This issue affect… |
CVE-2025-22790 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asmedia allows Reflected XSS.This issue affects moseter… |
CVE-2025-22789 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks polka dots allows Reflected XSS.This issue affe… |
CVE-2025-22687 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asmedia Tuaug4 allows Reflected XSS.This issue affects Tu… |
CVE-2025-22678 | High | 7.1 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mythemes my white allows Reflected XSS.This issue affects… |
CVE-2025-48341 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.Th… |
CVE-2025-48288 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2025-48277 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-48276 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcom… |
CVE-2025-48270 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows DOM-Based XSS.T… |
CVE-2025-48269 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.T… |
CVE-2025-48266 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2025-48263 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor all… |
CVE-2025-48258 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored… |
CVE-2025-48256 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events… |
CVE-2025-48254 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce… |
CVE-2025-48253 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shippin… |
CVE-2025-48252 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows St… |
CVE-2025-48251 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCo… |
CVE-2025-48250 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooComme… |
CVE-2025-48249 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows… |
CVE-2025-48248 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discou… |
CVE-2025-48244 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-… |
CVE-2025-48240 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce cost-of-goods-for… |