CWE-79 · Cross-site Scripting (page 98)
Page 98 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48239 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for Woo… |
CVE-2025-48237 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2025-48236 | High | 8.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows Stored XSS.This issue… |
CVE-2025-48235 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask wp-image-mask allows DOM-… |
CVE-2025-48234 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DO… |
CVE-2025-48232 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-be… |
CVE-2024-51106 | Medium | 4.6 | 2025-05-19 | A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows… |
CVE-2025-44108 | Medium | 4.8 | 2025-05-19 | A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacke… |
CVE-2025-32999 | Medium | 5.4 | 2025-05-19 | Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the en… |
CVE-2025-2561 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2560 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2524 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-1627 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is… |
CVE-2025-1626 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the… |
CVE-2025-1625 | Medium | 5.4 | 2025-05-19 | The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the b… |
CVE-2025-2892 | Medium | 6.4 | 2025-05-19 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pos… |
CVE-2025-4862 | Medium | 4.3 | 2025-05-18 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown func… |
CVE-2025-3715 | Medium | 6.4 | 2025-05-18 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5… |
CVE-2025-4860 | Low | 2.4 | 2025-05-18 | A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps… |
CVE-2025-4859 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the fi… |
CVE-2025-4858 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-4852 | Low | 2.4 | 2025-05-18 | A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the… |
CVE-2025-47931 | Medium | 6.1 | 2025-05-17 | LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the… |
CVE-2025-4669 | Medium | 6.4 | 2025-05-17 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including… |
CVE-2025-3888 | Medium | 6.4 | 2025-05-17 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to… |
CVE-2025-4610 | Medium | 6.4 | 2025-05-17 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all ver… |
CVE-2025-4805 | | 2025-05-16 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An a… | |
CVE-2025-4804 | | 2025-05-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the s… | |
CVE-2025-48135 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Ba… |
CVE-2025-48132 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows… |
CVE-2025-48131 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2025-48121 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-… |
CVE-2025-48113 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS… |
CVE-2025-48112 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc… |
CVE-2025-48080 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-47557 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affe… |
CVE-2025-46464 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.Thi… |
CVE-2025-39537 | High | 7.1 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-b… |
CVE-2025-39509 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows S… |
CVE-2025-32180 | Medium | 6.5 | 2025-05-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell wo… |
CVE-2025-40632 | Medium | 6.1 | 2025-05-16 | Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicio… |
CVE-2025-3516 | Medium | 5.9 | 2025-05-16 | The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could a… |
CVE-2025-3201 | Medium | 5.9 | 2025-05-16 | The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow hig… |
CVE-2025-4745 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_e… |
CVE-2025-4744 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-4169 | Medium | 6.4 | 2025-05-16 | The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and i… |
CVE-2024-51475 | Medium | 5.4 | 2025-05-16 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2025-47929 | | 2025-05-15 | DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload func… | |
CVE-2025-47786 | Medium | 4.8 | 2025-05-15 | Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct ma… |
CVE-2025-1454 | Medium | 5.4 | 2025-05-15 | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-1303 | Medium | 6.1 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2025-1289 | Medium | 4.8 | 2025-05-15 | The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2025-1286 | Medium | 6.1 | 2025-05-15 | The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-1033 | Medium | 4.8 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2025-0688 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0687 | Medium | 6.1 | 2025-05-15 | The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back i… |
CVE-2025-0329 | Medium | 4.8 | 2025-05-15 | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-9882 | Medium | 4.8 | 2025-05-15 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its set… |
CVE-2024-9663 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9662 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9645 | Medium | 5.4 | 2025-05-15 | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options be… |
CVE-2024-9599 | Medium | 5.4 | 2025-05-15 | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-9390 | Medium | 4.8 | 2025-05-15 | The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-9238 | Medium | 5.4 | 2025-05-15 | The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a maliciou… |
CVE-2024-9236 | Medium | 4.8 | 2025-05-15 | The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-9227 | Medium | 4.8 | 2025-05-15 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which coul… |
CVE-2024-9182 | Medium | 4.8 | 2025-05-15 | The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cr… |
CVE-2024-8854 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8851 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8759 | Medium | 4.8 | 2025-05-15 | The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-8703 | Medium | 6.1 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated… |
CVE-2024-8702 | Medium | 4.8 | 2025-05-15 | The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-8701 | Medium | 4.8 | 2025-05-15 | The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8670 | Medium | 4.8 | 2025-05-15 | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8620 | Medium | 4.8 | 2025-05-15 | The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8619 | Medium | 4.8 | 2025-05-15 | The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8618 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8617 | Medium | 4.8 | 2025-05-15 | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perfo… |
CVE-2024-8542 | Medium | 4.8 | 2025-05-15 | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8493 | Medium | 4.8 | 2025-05-15 | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-8492 | Medium | 4.8 | 2025-05-15 | The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform… |
CVE-2024-8426 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8397 | Medium | 5.4 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to co… |
CVE-2024-8284 | Medium | 4.8 | 2025-05-15 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors t… |
CVE-2024-8187 | Medium | 4.8 | 2025-05-15 | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8095 | Medium | 6.1 | 2025-05-15 | The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-7769 | Medium | 4.8 | 2025-05-15 | The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-7761 | Medium | 6.1 | 2025-05-15 | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of t… |
CVE-2024-7759 | Medium | 4.8 | 2025-05-15 | The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-7758 | Medium | 4.8 | 2025-05-15 | The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor… |
CVE-2024-7556 | Medium | 4.8 | 2025-05-15 | The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-6798 | Medium | 4.8 | 2025-05-15 | The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-6797 | Medium | 4.8 | 2025-05-15 | The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-6718 | Medium | 5.4 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-6713 | Medium | 4.8 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-6712 | Medium | 6.1 | 2025-05-15 | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow at… |
CVE-2024-6711 | Low | 3.5 | 2025-05-15 | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as… |
CVE-2024-6708 | Medium | 4.8 | 2025-05-15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which al… |
CVE-2024-6693 | Medium | 4.8 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-6668 | Medium | 5.4 | 2025-05-15 | The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role… |