CWE-79
CVEs classified under CWE-79, newest first.
5416 CVEsRSS
CVE-2026-110533Medium· 6.4FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sa…
CVE-2026-119761Medium· 6.1Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attacker…
CVE-2026-119365Medium· 6.5WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue …
CVE-2026-105456Medium· 5.3Stored XSS via HTML scrubber rule in RTIR
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change ap…
CVE-2026-105454Medium· 5.3Stored XSS via crafted URLs in HTML ticket content in Request Tracker
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is dis…
CVE-2026-105455Medium· 5.3Stored XSS via related ticket subject on RTIR Split and Create Incident forms
RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script r…
CVE-2026-61804High· 8.1myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management
myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through …
CVE-2026-116622High· 7.2Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and outp…
CVE-2026-85268High· 8.7Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary Java…
CVE-2026-118500Medium· 6.4Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7…
CVE-2026-97645High· 7.2Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…
CVE-2026-48164Medium· 4.7Collabora Online: Reflected HTML injection through host_session_id
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, un…
CVE-2026-119369Medium· 6.5WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a throu…
CVE-2025-68395Medium· 5.1Stored XSS in Protectel
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module…
CVE-2026-65444Medium· 6.5WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.
CVE-2026-119370Medium· 6.5WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a throu…
CVE-2026-61728Critical· 9.9PoCSOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit st…
CVE-2026-119680High· 8.5Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript i…
CVE-2026-115277Medium· 4.7WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The af…
CVE-2026-117571High· 8.8WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, all…
CVE-2026-118071Medium· 6.8Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site S…
CVE-2026-118165Medium· 6.8Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Store…
CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose na…
CVE-2026-108515NoneDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11…
CVE-2026-110738NoneGin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 …
CVE-2026-108514NoneDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 1…
CVE-2026-114527NoneUI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
CVE-2026-114526NoneBlack Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
CVE-2026-114528NoneZero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.
CVE-2026-114525NoneABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.