CWE-79
CVEs classified under CWE-79, newest first.
5407 CVEsRSS
CVE-2026-104926Medium· 6.1WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input …
CVE-2026-111070Medium· 5.4Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from e…
CVE-2026-120075High· 7.2WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated atta…
CVE-2026-119160Medium· 6.4Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to…
CVE-2026-110530High· 7.2FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips th…
CVE-2026-96554Medium· 6.4BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for au…
CVE-2026-116752Medium· 6.4GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insu…
CVE-2026-100151Medium· 6.1Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, an…
CVE-2026-120114High· 7.2Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient i…
CVE-2026-107711Medium· 6.4FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insuf…
CVE-2026-118438Medium· 6.8Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts …
CVE-2026-78190NoneWebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request p…
CVE-2026-62990High· 8.7PoCShopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the admin…
CVE-2026-119764Medium· 6.8PoCMythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator …
CVE-2026-45144High· 8.9Chamilo LMS: Stored XSS in public user-profile fields
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, …
CVE-2015-20130Medium· 6.1PoCNetsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code thr…
CVE-2026-28160High· 7.1WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.
CVE-2026-111578High· 7.5PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note —…
CVE-2026-48201High· 7.1WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
CVE-2026-7004Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter t…
CVE-2026-107308Low· 3.1Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.
CVE-2026-117645Medium· 5.3Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Ph…
CVE-2026-107306Low· 3.8Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
CVE-2026-107265Medium· 5.4Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-114555Low· 3.5Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.
CVE-2026-107252Medium· 5.4MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 t…
CVE-2026-54855High· 7.1WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
CVE-2026-39786High· 7.1WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
CVE-2026-27061Medium· 6.5WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
CVE-2026-94175High· 7.1WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.