CWE-79
CVEs classified under CWE-79, newest first.
5597 CVEsRSS
CVE-2026-97298Medium· 6.5Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
CVE-2026-97301Medium· 6.5Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
CVE-2026-102384Medium· 5.9Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
CVE-2026-100513Medium· 6.5Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
CVE-2026-100507High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Persona…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Persona…
CVE-2026-102386Medium· 6.5Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
CVE-2026-102385High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
CVE-2026-102398High· 7.1Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
CVE-2026-102395High· 7.1Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
CVE-2026-102396High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
CVE-2026-97253High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
CVE-2026-97235High· 7.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-96450Medium· 5.4Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
CVE-2026-97237High· 7.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
CVE-2026-97236Medium· 6.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97238Medium· 5.5Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
CVE-2026-103321High· 8.3MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was render…
CVE-2025-14564Medium· 6.4The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it po…
CVE-2026-97347High· 7.2PoCThe Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it po…
CVE-2026-93908Medium· 6.4The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input s…
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input s…
CVE-2026-92712Medium· 6.4The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output…
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output…
CVE-2026-102581Medium· 4.6A flaw was found in Moodle
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes …
CVE-2026-102459Medium· 6.1EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability
EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVE-2026-102586Medium· 4.3A flaw was found in Moodle
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially craft…
CVE-2026-93463Medium· 5.4A cross-site scripting vulnerability via script validation bypass exists in baserCMS
A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVE-2026-6172Medium· 6.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization …
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization …
CVE-2026-93464Medium· 5.4A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVE-2026-93460Medium· 5.4A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVE-2026-88037Medium· 6.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitizatio…
CVE-2026-6170Medium· 6.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanit…
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanit…