CWE-79 · Cross-site Scripting (page 99)
Page 99 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6667 | Medium | 6.1 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2024-6665 | Medium | 4.8 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-6478 | Medium | 4.8 | 2025-05-15 | The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-6462 | Medium | 4.8 | 2025-05-15 | The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-6335 | Medium | 4.8 | 2025-05-15 | The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-5440 | Medium | 5.4 | 2025-05-15 | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2024-5026 | Medium | 4.8 | 2025-05-15 | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4091 | Low | 3.5 | 2025-05-15 | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4004 | Low | 3.5 | 2025-05-15 | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4002 | Low | 3.5 | 2025-05-15 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-3996 | Low | 3.5 | 2025-05-15 | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-3901 | Medium | 6.8 | 2025-05-15 | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allow… |
CVE-2024-3062 | Medium | 4.8 | 2025-05-15 | The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-2869 | Medium | 4.8 | 2025-05-15 | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-2643 | Medium | 4.8 | 2025-05-15 | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and esca… |
CVE-2024-1663 | Medium | 4.8 | 2025-05-15 | The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-13865 | Medium | 6.1 | 2025-05-15 | The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13828 | Medium | 6.1 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13823 | Medium | 6.1 | 2025-05-15 | The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-13730 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13729 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-13727 | Medium | 6.1 | 2025-05-15 | The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-13621 | Medium | 4.8 | 2025-05-15 | The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13619 | Medium | 6.1 | 2025-05-15 | The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13616 | Medium | 4.8 | 2025-05-15 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege use… |
CVE-2024-13486 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13482 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13384 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-13383 | Medium | 4.8 | 2025-05-15 | The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-13382 | Medium | 4.8 | 2025-05-15 | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-13357 | Medium | 4.8 | 2025-05-15 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-13313 | Medium | 4.8 | 2025-05-15 | The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-13128 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13127 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13053 | Medium | 4.8 | 2025-05-15 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12874 | Medium | 4.8 | 2025-05-15 | The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-12873 | Medium | 6.1 | 2025-05-15 | The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-12808 | Medium | 4.8 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape so… |
CVE-2024-12800 | Medium | 4.8 | 2025-05-15 | The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Store… |
CVE-2024-12770 | Medium | 4.8 | 2025-05-15 | The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12743 | Medium | 4.8 | 2025-05-15 | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12739 | Medium | 4.8 | 2025-05-15 | The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12734 | Medium | 6.1 | 2025-05-15 | The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outp… |
CVE-2024-12733 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12732 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12726 | Medium | 6.1 | 2025-05-15 | The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scri… |
CVE-2024-12725 | Medium | 6.1 | 2025-05-15 | The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2024-12724 | Medium | 6.1 | 2025-05-15 | The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-12722 | Medium | 5.4 | 2025-05-15 | The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before output… |
CVE-2024-12716 | Medium | 4.8 | 2025-05-15 | The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-12680 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-12679 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-11843 | Medium | 4.8 | 2025-05-15 | The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11718 | Medium | 5.4 | 2025-05-15 | The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contribut… |
CVE-2024-11502 | Medium | 5.4 | 2025-05-15 | The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2024-11266 | Medium | 4.8 | 2025-05-15 | The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-11221 | Medium | 4.8 | 2025-05-15 | The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-11190 | Medium | 4.8 | 2025-05-15 | The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11189 | Medium | 4.8 | 2025-05-15 | The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-11141 | Medium | 6.1 | 2025-05-15 | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscr… |
CVE-2024-11140 | Low | 3.5 | 2025-05-15 | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2024-11109 | Medium | 4.8 | 2025-05-15 | The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10818 | Medium | 5.4 | 2025-05-15 | The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-10639 | Medium | 4.8 | 2025-05-15 | The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-10632 | Medium | 4.8 | 2025-05-15 | The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to… |
CVE-2024-10631 | Medium | 6.5 | 2025-05-15 | The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them bac… |
CVE-2024-10504 | Medium | 5.4 | 2025-05-15 | The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the pag… |
CVE-2024-10475 | Medium | 4.8 | 2025-05-15 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-10362 | Medium | 4.8 | 2025-05-15 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-p… |
CVE-2024-10149 | Medium | 4.8 | 2025-05-15 | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10145 | Medium | 4.8 | 2025-05-15 | The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10144 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-10143 | Medium | 4.8 | 2025-05-15 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10107 | Medium | 4.8 | 2025-05-15 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10076 | Medium | 5.9 | 2025-05-15 | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs… |
CVE-2024-10054 | Medium | 4.8 | 2025-05-15 | The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-0852 | High | 8.8 | 2025-05-15 | The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing… |
CVE-2024-0249 | High | 7.1 | 2025-05-15 | The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect… |
CVE-2023-7230 | Medium | 6.1 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform… |
CVE-2023-7228 | Medium | 6.1 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site… |
CVE-2023-7168 | Medium | 4.8 | 2025-05-15 | The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2023-7088 | Medium | 5.4 | 2025-05-15 | The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as… |
CVE-2023-7086 | Medium | 5.4 | 2025-05-15 | The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a m… |
CVE-2023-6783 | Medium | 4.8 | 2025-05-15 | The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-6541 | Medium | 6.1 | 2025-05-15 | The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SV… |
CVE-2023-5932 | Medium | 4.8 | 2025-05-15 | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2023-5529 | Medium | 4.8 | 2025-05-15 | The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2025-44110 | Medium | 5.4 | 2025-05-15 | FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php. |
CVE-2025-1647 | Medium | 5.6 | 2025-05-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48051 | Medium | 4.7 | 2025-05-15 | powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM no… |
CVE-2025-3440 | Medium | 5.5 | 2025-05-15 | IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the… |
CVE-2025-44183 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters. |
CVE-2025-44182 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasi… |
CVE-2025-44181 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter. |
CVE-2025-44180 | Medium | 6.1 | 2025-05-15 | Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}. |
CVE-2025-3742 | Medium | 6.8 | 2025-05-15 | The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post… |
CVE-2025-4591 | Medium | 6.4 | 2025-05-15 | The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including… |
CVE-2025-4589 | Medium | 6.4 | 2025-05-15 | The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3… |
CVE-2025-4579 | High | 7.2 | 2025-05-15 | The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all… |
CVE-2025-47783 | Medium | 6.1 | 2025-05-14 | Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script int… |