CWE-79

CVEs classified under CWE-79, newest first.

5600 CVEsRSS

CVE-2026-77394High· 7.6PoC

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /ope…

▾ MidnightOpenC3 · cosmosEPSS 0.42%via NVD

CVE-2026-92730High· 7.4

1mo ago

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

▾ TwilightLimeSurvey · LimeSurveyEPSS 0.53%via NVD

CVE-2026-93526High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

▾ TwilightNexcess · event-ticketsEPSS 0.25%via NVD

CVE-2026-93622High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

▾ TwilightNicolasKulka · wps-limit-loginEPSS 0.25%via NVD

CVE-2026-93772Medium· 6.5

1mo ago

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

▾ SunlitTomdever · wpforoEPSS 0.22%via NVD

CVE-2026-93774High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

▾ TwilightJacob N. Breetvelt · wp-photo-album-plusEPSS 0.25%via NVD

CVE-2026-94118Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

▾ SunlitLeap13 · premium-blocks-for-gutenbergEPSS 0.22%via NVD

CVE-2026-94168Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

▾ SunlitLeap13 · premium-addons-for-elementorEPSS 0.22%via NVD

CVE-2026-94176High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

▾ TwilightKitae Park · mangboardEPSS 0.25%via NVD

CVE-2026-94179High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

▾ TwilightRazorpay · razorpay-payment-buttonEPSS 0.25%via NVD

CVE-2026-94461Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

▾ Sunlitmetaphorcreations · ditty-news-tickerEPSS 0.22%via NVD

CVE-2026-94391Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

▾ SunlitRustaurius · ultimate-faqsEPSS 0.22%via NVD

CVE-2026-94500Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

▾ SunlitRoxnor · elementskit-liteEPSS 0.22%via NVD

CVE-2026-94671Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

▾ SunlitRadiusTheme · the-post-gridEPSS 0.22%via NVD

CVE-2026-94680Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

▾ SunlitRadiusTheme · the-post-gridEPSS 0.22%via NVD

CVE-2026-94684Medium· 6.5

1mo ago

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection.

▾ Sunlitoceanwp · ocean-extraEPSS 0.17%via NVD

CVE-2026-94682Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

▾ SunlitSecondLineThemes · podcast-importer-secondlineEPSS 0.22%via NVD

CVE-2026-95515High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

▾ TwilightKevin Stover · ninja-formsEPSS 0.19%via NVD

CVE-2026-95530Medium· 6.5

1mo ago

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

▾ SunlitPixelYourSite · pixelyoursiteEPSS 0.22%via NVD

CVE-2026-95529High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

▾ Twilightcodepeople · calculated-fields-formEPSS 0.25%via NVD

CVE-2026-95528High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

▾ TwilightMohammed Kaludi · core-web-vitals-pagespeed-boosterEPSS 0.25%via NVD

CVE-2026-95586Medium· 6.5

1mo ago

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

▾ SunlitThemefic · ultimate-addons-for-contact-form-7EPSS 0.22%via NVD

CVE-2026-93618Medium· 6.5

1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.

▾ SunlitCrocoblock. Jetimpex Inc. · JetTricksEPSS 0.22%via NVD

CVE-2026-91775High· 7.4PoC

1mo ago

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

▾ MidnightLimeSurvey · LimeSurveyEPSS 0.52%via NVD

CVE-2026-93769High· 7.2

1mo ago

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …

▾ TwilightHumhub · HumhubEPSS 0.49%via NVD

CVE-2026-18872Critical· 9.3

1mo ago

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42)

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script …

▾ Midnightibm · financial_transaction_managerEPSS 0.31%via NVD

CVE-2026-63001Medium· 4.8

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it whe…

▾ Sunlitredaxo · coreEPSS 0.20%via NVD

CVE-2026-63002Medium· 4.8PoC

1mo ago

REDAXO is a PHP-based content management system

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker wh…

▾ Twilightredaxo · coreEPSS 0.20%via NVD

CVE-2026-59167Critical· 10.0PoC

1mo ago

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler…

▾ Abyssalsuneditor · suneditorEPSS 0.50%via NVD

CVE-2026-5696Medium· 5.9

1mo ago

Reflected Cross-Site Scripting (XSS) in Microweber

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user int…

▾ SunlitMicroweber · Administration panelEPSS 0.42%via NVD