CWE-79
CVEs classified under CWE-79, newest first.
5545 CVEsRSS
CVE-2026-105798High· 8.7PoCSimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that gro…
CVE-2026-12380Medium· 6.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-1…
CVE-2025-15591Medium· 5.3Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
CVE-2026-105808Low· 3.5PoCA vulnerability was determined in SourceCodester Simple Student Information System 1.0
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross sit…
CVE-2026-103346High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a thr…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a thr…
CVE-2026-105879Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.…
CVE-2026-105809Medium· 4.3PoCA vulnerability was identified in SourceCodester Simple Student Information System 1.0
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstna…
CVE-2026-32570High· 7.1Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
CVE-2026-32569High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
CVE-2026-32577High· 7.1Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
CVE-2026-32572High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-32571Medium· 6.5Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
CVE-2026-32575High· 7.1Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
CVE-2026-32574High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
CVE-2026-39724High· 7.1Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
CVE-2026-39727Medium· 6.5Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
CVE-2026-39726High· 7.1Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
CVE-2026-39720High· 7.1Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
CVE-2026-39722High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
CVE-2026-39731High· 7.1Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
CVE-2026-39745High· 7.1Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
CVE-2026-39748High· 7.1Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
CVE-2026-39750High· 7.1Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
CVE-2026-39766High· 7.1Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVE-2026-39758High· 7.1Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
CVE-2026-39784High· 7.1Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
CVE-2026-39768High· 7.1Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive.
CVE-2026-39788Medium· 6.5Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.
Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.
CVE-2026-39781High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
CVE-2026-39778High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.