CWE-79
CVEs classified under CWE-79, newest first.
5595 CVEsRSS
CVE-2026-39781High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
CVE-2026-39778High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
CVE-2026-39780High· 7.1Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
CVE-2026-39790High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.
CVE-2026-40806High· 7.1Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
CVE-2026-40807High· 7.1Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
CVE-2026-42635High· 7.1Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
CVE-2026-42418High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
CVE-2026-42636High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
CVE-2026-42634High· 7.1Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
CVE-2026-94675High· 7.1Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
CVE-2026-104670High· 7.1Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
CVE-2026-104395High· 7.1Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
CVE-2026-104394High· 7.1Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
CVE-2026-104814High· 7.1Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
CVE-2026-104672High· 7.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
CVE-2026-105061High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
CVE-2026-39760High· 7.1Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
CVE-2026-105708Medium· 4.3PoCA flaw has been found in imgproxy up to 4.0.17
A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It …
CVE-2026-75962High· 7.2The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and…
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and…
CVE-2026-105705Medium· 4.3PoCA security flaw has been discovered in SourceCodester Drug Recommendation System 1.0
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to b…
CVE-2026-105784Medium· 4.6PoCJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app…
GHSA-6688-9rhm-gjv2LowDOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
GHSA-g2v6-rqmx-r4w6High· 7.2@vue/server-renderer: XSS via missing CR in attribute-name blacklist
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
CVE-2026-105694Medium· 5.4PoCPenpot is an open-source design and prototyping platform
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitiza…
CVE-2026-105679High· 7.3Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restri…
CVE-2026-105649High· 7.3Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to …
CVE-2026-105650High· 8.1Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on th…
CVE-2026-105651High· 7.3Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, inclu…
CVE-2026-95166Medium· 5.4PoCIn Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.