Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,854 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-73338 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. | |
CVE-2026-73342 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. | |
CVE-2026-73351 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions. | |
CVE-2026-73358 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. | |
CVE-2026-73360 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. | |
CVE-2026-73361 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 | |
CVE-2026-73362 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions. | |
CVE-2026-73375 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | |
CVE-2026-73378 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. | |
CVE-2026-73393 |
high | 7.1 | 0.0025 | 2026-08-18 | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. | |
CVE-2026-16570 |
high | 7.1 | 0.0025 | 2026-08-19 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of t | |
CVE-2026-19055 |
high | 7.1 | 0.0025 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parame | |
CVE-2026-19056 |
high | 7.1 | 0.0025 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter be | |
CVE-2026-97237 |
high | 7.1 | 0.0018 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-111830 |
high | 7.1 | 0.0020 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112379 |
high | 7.1 | 0.0019 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112313 |
high | 7.1 | 0.0019 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112835 |
high | 7.1 | 0.0019 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112838 |
high | 7.1 | 0.0019 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112849 |
high | 7.1 | 0.0019 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112863 |
high | 7.1 | 0.0015 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115457 |
high | 7.1 | 0.0029 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-112207 |
high | 7.1 | 0.0021 | 2026-10-24 | The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link be | |
CVE-2026-112844 |
high | 7.1 | 0.0020 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-112869 |
high | 7.1 | 0.0020 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-114178 |
high | 7.1 | 0.0021 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-114179 |
high | 7.1 | 0.0020 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-114694 |
high | 7.1 | 0.0025 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-114695 |
high | 7.1 | 0.0021 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-114697 |
high | 7.1 | 0.0021 | 2026-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115592 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115611 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-116409 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42693 |
high | 7.1 | 0.0018 | 2026-10-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-108494 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. | |
CVE-2026-118085 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. | |
CVE-2026-27394 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | |
CVE-2026-42692 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | |
CVE-2026-54864 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | |
CVE-2026-54866 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 vers | |
CVE-2026-61988 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versio | |
CVE-2026-61989 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | |
CVE-2026-61993 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. | |
CVE-2026-61995 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | |
CVE-2025-40772 |
high | 7.0 | 0.0032 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server appl | |
CVE-2026-3457 |
high | 7.0 | 0.0013 | 2026-03-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-40875 |
high | 7.0 | 0.0024 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-41653 |
high | 7.0 | 0.0036 | 2026-05-07 | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site sc | |
CVE-2026-54301 |
high | 7.0 | 0.0024 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen | |
CVE-2026-54302 |
high | 7.0 | 0.0023 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen |