CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 2)
Page 2 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39344 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is… |
CVE-2026-35460 | Medium | 4.3 | 2026-04-07 | Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into… |
CVE-2025-66486 | Medium | 4.8 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2026-0396 | Low | 3.1 | 2026-03-31 | An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynami… |
CVE-2026-1834 | Medium | 6.4 | 2026-03-31 | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to… |
CVE-2026-2995 | High | 7.7 | 2026-03-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowe… |
CVE-2026-33080 | High | 7.3 | 2026-03-20 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament T… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |
CVE-2026-29106 | Medium | 5.9 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the… |
CVE-2026-32753 | Medium | 5.4 | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG… |
CVE-2026-27166 | Medium | 4.1 | 2026-03-19 | Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allow… |
CVE-2026-28499 | Medium | 6.1 | 2026-03-18 | LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection… |
CVE-2026-32732 | | 2026-03-16 | Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable… | |
CVE-2025-59540 | Medium | 5.4 | 2026-03-06 | Chamilo is a learning management system. Prior to version 1.11.34, a stored XSS vulnerability exists in Chamilo LMS that allows a staff account to execute arbi… |
CVE-2026-20070 | Medium | 6.1 | 2026-03-04 | A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense… |
CVE-2025-52564 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacke… |
CVE-2025-52563 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitizati… |
CVE-2026-28132 | Medium | 5.3 | 2026-02-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews a… |
CVE-2026-27578 | Medium | 5.4 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-27116 | Medium | 6.1 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module… |
CVE-2026-27458 | Medium | 5.4 | 2026-02-21 | LinkAce is a self-hosted archive to collect website links. Versions 2.4.2 and below have a Stored Cross-site Scripting vulnerability through the Atom feed endp… |
CVE-2026-25006 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XS… |
CVE-2026-22422 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This… |
CVE-2025-14289 | Medium | 5.4 | 2026-02-17 | IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2026-25935 | Medium | 5.4 | 2026-02-11 | Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since t… |
CVE-2026-1282 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allow… |
CVE-2025-12803 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and includ… |
CVE-2026-25764 | Low | 3.5 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time t… |
CVE-2026-22254 | Unrated | | 2026-02-06 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access… |
CVE-2026-25578 | Medium | 6.1 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allow… |
CVE-2026-25054 | Medium | 5.4 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rende… |
CVE-2025-65924 | Medium | 4.1 | 2026-02-03 | ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScrip… |
CVE-2025-45160 | Medium | 5.4 | 2026-01-29 | A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application refl… |
CVE-2026-24128 | Medium | 6.1 | 2026-01-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1… |
CVE-2026-24564 | Medium | 4.3 | 2026-01-23 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Israpil Textmetrics webtexttool allows Code Injection.This issue… |
CVE-2026-22469 | Medium | 5.3 | 2026-01-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in mwtemplates DeepDigital deepdigital allows Code Injection.This i… |
CVE-2025-47600 | Medium | 5.3 | 2026-01-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affect… |
CVE-2025-36397 | Medium | 5.4 | 2026-01-20 | IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be ex… |
CVE-2026-1154 | Medium | 4.3 | 2026-01-19 | A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Le… |
CVE-2026-23528 | Medium | 6.1 | 2026-01-16 | Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together… |
CVE-2026-20047 | Medium | 4.8 | 2026-01-15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an… |
CVE-2025-69169 | Medium | 5.4 | 2026-01-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflect… |
CVE-2025-15058 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and in… |
CVE-2025-14835 | High | 7.1 | 2026-01-07 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including… |
CVE-2025-14792 | Medium | 4.4 | 2026-01-07 | The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to… |
CVE-2025-45286 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2025-36230 | Medium | 5.4 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2025-14735 | Medium | 4.4 | 2025-12-20 | The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1… |
CVE-2025-64225 | Medium | 6.5 | 2025-12-18 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This… |
CVE-2025-64633 | Medium | 5.3 | 2025-12-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This… |
CVE-2025-66450 | Medium | 5.4 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can… |
CVE-2025-66472 | Medium | 6.1 | 2025-12-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc… |
CVE-2025-63068 | Medium | 5.3 | 2025-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-… |
CVE-2025-66481 | Critical | 9.6 | 2025-12-09 | DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sani… |
CVE-2025-14186 | Low | 3.5 | 2025-12-07 | A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the com… |
CVE-2025-66512 | Medium | 5.4 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed… |
CVE-2025-13505 | Medium | 4.8 | 2025-12-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page… |
CVE-2025-54057 | Medium | 6.1 | 2025-11-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10… |
CVE-2025-64764 | High | 7.1 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application… |
CVE-2025-58412 | Medium | 4.7 | 2025-11-19 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiAD… |
CVE-2025-11267 | Medium | 6.4 | 2025-11-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter in all versions up to, a… |
CVE-2025-11265 | Medium | 6.4 | 2025-11-18 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' pa… |
CVE-2025-8386 | Medium | 6.9 | 2025-11-15 | The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persis… |
CVE-2025-13180 | Low | 3.5 | 2025-11-14 | A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of t… |
CVE-2025-13178 | Low | 3.5 | 2025-11-14 | A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Pro… |
CVE-2025-54348 | Medium | 6.5 | 2025-11-14 | A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an at… |
CVE-2025-54346 | High | 7.6 | 2025-11-14 | A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an… |
CVE-2025-12753 | Medium | 6.4 | 2025-11-11 | The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. T… |
CVE-2025-11874 | Medium | 5.4 | 2025-11-11 | The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slippy-slider' short… |
CVE-2025-64187 | Medium | 4.4 | 2025-11-07 | OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arb… |
CVE-2025-33110 | Medium | 5.4 | 2025-11-06 | IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-60244 | High | 7.1 | 2025-11-06 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection… |
CVE-2025-49398 | Medium | 6.5 | 2025-11-06 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Cod… |
CVE-2025-11745 | Medium | 6.4 | 2025-11-05 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter'… |
CVE-2025-11987 | Medium | 6.4 | 2025-11-05 | The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and… |
CVE-2025-48884 | Medium | 6.1 | 2025-11-04 | Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-… |
CVE-2025-53883 | | 2025-10-30 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS… | |
CVE-2025-39663 | High | 8.4 | 2025-10-30 | Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service output… |
CVE-2025-62796 | Medium | 5.8 | 2025-10-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsan… |
CVE-2025-36121 | Medium | 5.4 | 2025-10-27 | IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be exec… |
CVE-2025-62936 | Medium | 4.3 | 2025-10-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects x… |
CVE-2025-62897 | Medium | 5.3 | 2025-10-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.Thi… |
CVE-2025-11823 | Medium | 6.4 | 2025-10-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-11992 | Medium | 6.1 | 2025-10-24 | The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to mis… |
CVE-2025-58970 | Medium | 6.3 | 2025-10-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue af… |
CVE-2025-11966 | Medium | 6.4 | 2025-10-22 | In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML w… |
CVE-2025-62418 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (… |
CVE-2025-62415 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (… |
CVE-2025-62414 | Medium | 6.9 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scr… |
CVE-2025-0277 | Medium | 6.5 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into p… |
CVE-2025-0276 | Medium | 6.5 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker… |
CVE-2025-11161 | Medium | 6.4 | 2025-10-15 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and incl… |
CVE-2025-11160 | Medium | 6.4 | 2025-10-15 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6… |
CVE-2025-62172 | | 2025-10-14 | Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard… | |
CVE-2025-31992 | Medium | 4.6 | 2025-10-12 | HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the… |
CVE-2025-10496 | High | 7.2 | 2025-10-09 | The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6… |
CVE-2025-52654 | Medium | 4.6 | 2025-10-03 | HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially all… |
CVE-2025-11241 | Medium | 6.4 | 2025-10-03 | The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attrib… |
CVE-2025-61583 | Medium | 4.3 | 2025-10-01 | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 an… |
CVE-2025-58054 | Low | 3.5 | 2025-10-01 | Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel… |