VulnSea

CWE-79

CVEs classified under CWE-79, newest first.

5416 CVEsRSS

CVE-2026-114529None
1w ago

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

▾ SunlitDrupal · CSV FieldEPSS 0.16%via CVEORG
CVE-2026-114532None
1w ago

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

▾ SunlitDrupal · UI IconsEPSS 0.16%via CVEORG
CVE-2026-107260None
1w ago

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.…

▾ SunlitDrupal · Sector DistributionEPSS 0.16%via CVEORG
CVE-2026-114531None
1w ago

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

▾ SunlitDrupal · Swiper formatterEPSS 0.16%via CVEORG
CVE-2026-114534None
1w ago

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

▾ SunlitDrupal · Block AttributesEPSS 0.16%via CVEORG
CVE-2026-114536None
1w ago

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

▾ SunlitDrupal · USWDS Paragraph ComponentsEPSS 0.16%via CVEORG
CVE-2026-114538None
1w ago

Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

▾ SunlitDrupal · BootstrapEPSS 0.16%via CVEORG
CVE-2026-118560Medium· 5.1
1w ago

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

▾ SunlitDrupal · Commerce StripeEPSS 0.16%via CVEORG
CVE-2026-118545Medium· 6.5
1w ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118549High· 7.1
1w ago

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ TwilightDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118546Medium· 6.5
1w ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118552Medium· 6.5
1w ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118553Medium· 5.5
1w ago

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, …

▾ SunlitDrupal · AI (Artificial Intelligence)EPSS 0.17%via CVEORG
CVE-2026-118575Medium· 6.1
1w ago

Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

▾ SunlitDrupal · Signature pad widgetEPSS 0.16%via CVEORG
CVE-2026-118576Medium· 6.5
1w ago

Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.…

▾ SunlitDrupal · Stage File ProxyEPSS 0.16%via CVEORG
CVE-2026-96632High
1w ago

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

▾ Twilightadminneo-org · adminneo-org/adminneovia GHSA
CVE-2026-27394High· 7.1
1w ago

WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

▾ TwilightJyothis Joy · eventerEPSS 0.18%via CVEORG
CVE-2026-118085High· 7.1
1w ago

WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

▾ TwilightGlobal Payments · global-payments-woocommerceEPSS 0.18%via CVEORG
CVE-2026-54864High· 7.1
1w ago

WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

▾ Twilightnicashmu · video-playlist-and-gallery-pluginEPSS 0.18%via CVEORG
CVE-2026-61989High· 7.1
1w ago

WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

▾ TwilightMerv Barrett · easy-property-listingsEPSS 0.18%via CVEORG
CVE-2026-54865Medium· 6.5
1w ago

WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

▾ SunlitPodamibe Nepal · podamibe-custom-user-gravatarEPSS 0.22%via CVEORG
CVE-2026-116848Medium· 6.5
1w ago

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This …

▾ SunlitPOSIMYTH Innovations · the-plus-addons-for-elementor-page-builderEPSS 0.13%via CVEORG
CVE-2026-115610Medium· 6.5
1w ago

WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.

▾ SunlitPublishPress · publishpress-authorsEPSS 0.14%via CVEORG
CVE-2026-114706Medium· 6.5
1w ago

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

▾ SunlitWP Chill · strong-testimonialsEPSS 0.13%via CVEORG
CVE-2026-61719High· 8.9PoC
1w ago

WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without …

▾ MidnightLabRedesCefetRJ · WeGIAEPSS 0.24%via CVEORG
CVE-2026-61673Medium· 6.3PoC
1w ago

WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `…

▾ TwilightLabRedesCefetRJ · WeGIAEPSS 0.33%via CVEORG
CVE-2026-108494High· 7.1
1w ago

WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

▾ TwilightBob · chained-quizEPSS 0.19%via CVEORG
CVE-2026-61995High· 7.1
1w ago

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

▾ Twilightemarket-design · youtube-showcaseEPSS 0.23%via CVEORG
CVE-2026-61988High· 7.1
1w ago

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

▾ Twilightmorehawes · auction-nudgeEPSS 0.24%via CVEORG
CVE-2026-42692High· 7.1
1w ago

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

▾ TwilightThemeum · wp-crowdfundingEPSS 0.24%via CVEORG
CWE-79 vulnerabilities (CVEs) — page 10 · VulnSea