VulnSea

CWE-79

CVEs classified under CWE-79, newest first.

5421 CVEsRSS

CVE-2026-108494High· 7.1
1w ago

WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

▾ TwilightBob · chained-quizEPSS 0.19%via CVEORG
CVE-2026-61995High· 7.1
1w ago

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

▾ Twilightemarket-design · youtube-showcaseEPSS 0.23%via CVEORG
CVE-2026-61988High· 7.1
1w ago

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

▾ Twilightmorehawes · auction-nudgeEPSS 0.24%via CVEORG
CVE-2026-42692High· 7.1
1w ago

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

▾ TwilightThemeum · wp-crowdfundingEPSS 0.24%via CVEORG
CVE-2026-118097Medium· 6.5
1w ago

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

▾ SunlitbPlugins · html5-video-playerEPSS 0.17%via CVEORG
CVE-2026-39737Medium· 6.5
1w ago

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.…

▾ SunlitCrocoblock · jet-elementsEPSS 0.17%via CVEORG
CVE-2026-54866High· 7.1
1w ago

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

▾ TwilightRazorpay · razorpay-payment-button-elementorEPSS 0.24%via CVEORG
CVE-2026-61993High· 7.1
1w ago

WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

▾ Twilightblockonomics · blockonomics-bitcoin-paymentsEPSS 0.23%via CVEORG
CVE-2026-116857Medium· 6.5
1w ago

WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

▾ SunlitCrocoblock · jet-smart-filtersEPSS 0.20%via CVEORG
CVE-2026-116849Medium· 6.5
1w ago

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

▾ SunlitbPlugins · streamcastEPSS 0.18%via CVEORG
CVE-2026-110881Medium· 6.5
1w ago

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

▾ SunlitBrainstorm Force · suredashEPSS 0.17%via CVEORG
CVE-2026-116850Medium· 6.5
1w ago

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a thro…

▾ SunlitweDevs · happy-elementor-addonsEPSS 0.18%via CVEORG
CVE-2026-118095Medium· 6.5
1w ago

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a…

▾ SunlitDavid Lingren · media-library-assistantEPSS 0.18%via CVEORG
CVE-2026-66912Medium· 5.3
1w ago

Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email contai…

▾ SunlitSynacor · Zimbra CollaborationEPSS 0.47%via CVEORG
CVE-2026-66911Medium· 5.3
1w ago

Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthentica…

▾ SunlitSynacor · Zimbra CollaborationEPSS 0.54%via CVEORG
CVE-2026-39742Medium· 6.5
1w ago

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kaden…

▾ SunlitLiquid Web / StellarWP · kadence-blocksEPSS 0.19%via CVEORG
CVE-2026-113690Medium· 4.8
1w ago

Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG
CVE-2026-113689Medium· 5.1
1w ago

Stored Cross-Site Scripting in BMC ITSM Work Notes

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG
CVE-2026-113691Medium· 5.1
1w ago

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.43%via CVEORG
CVE-2026-113695Medium· 4.8
1w ago

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by ano…

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG
CVE-2026-113697Medium· 4.8
1w ago

Reflected Cross-Site Scripting in BMC Helix Operations Management

Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.

▾ SunlitBMC · BMC Helix Operations ManagementEPSS 0.43%via CVEORG
CVE-2026-118087Medium· 6.5
1w ago

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

▾ SunlitGemini Labs · site-reviewsEPSS 0.17%via CVEORG
CVE-2026-52709Medium· 6.5
1w ago

WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

▾ SunlitbPlugins · video-gallery-blockEPSS 0.17%via CVEORG
CVE-2026-24533Medium· 6.5
1w ago

WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

▾ SunlitCozyThemes · cozy-addonsEPSS 0.17%via CVEORG
CVE-2026-118094Medium· 6.5
1w ago

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

▾ SunlitIgor Funa · ad-inserterEPSS 0.17%via CVEORG
CVE-2026-56056Medium· 6.5
1w ago

WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.

▾ SunlitMamunur Rashid · the-post-gridEPSS 0.17%via CVEORG
CVE-2026-48196Medium· 6.5
1w ago

WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

▾ SunlitKaliforms · kali-formsEPSS 0.17%via CVEORG
CVE-2026-48195Medium· 6.5
1w ago

WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

▾ SunlitbPlugins · pdf-posterEPSS 0.17%via CVEORG
CVE-2026-54862Medium· 6.5
1w ago

WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export …

▾ SunlitCodection · import-users-from-csv-with-metaEPSS 0.17%via CVEORG
CVE-2026-119054Medium· 5.4
1w ago

Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store …

▾ SunlitThemeisle · Multiple Pages Generator by ThemeisleEPSS 0.23%via CVEORG
CWE-79 vulnerabilities (CVEs) — page 11 · VulnSea