CWE-79
High likelihoodImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
45,771 vulnerabilities with CWE-79
CVE-2026-9738
MEDIUM
Print, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter
CVSS 4.4
CVE-2026-15097
MEDIUM
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
CVSS 6.4
CVE-2026-15096
MEDIUM
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
CVSS 6.4
CVE-2026-12141
MEDIUM
Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
CVSS 4.9
CVE-2026-5743
MEDIUM
Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute
CVSS 6.4
CVE-2026-3367
MEDIUM
Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting
CVSS 4.4
CVE-2026-13114
HIGH
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
CVSS 7.2
CVE-2026-11913
CRITICAL
Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045
CVSS 9.8
CVE-2026-58591
MEDIUM
Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069
CVSS 5.4
CVE-2026-58588
MEDIUM
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066
CVSS 6.1
CVE-2026-58587
MEDIUM
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065
CVSS 6.1
CVE-2026-55808
MEDIUM
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
CVSS 5.4
CVE-2026-15085
MEDIUM
AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076
CVSS 5.4
CVE-2026-15084
MEDIUM
UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075
CVSS 5.4
CVE-2026-15082
MEDIUM
Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073
CVSS 5.4
CVE-2026-13234
MEDIUM
AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
CVSS 6.1
CVE-2026-13231
MEDIUM
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
CVSS 6.1
CVE-2026-11908
MEDIUM
Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
CVSS 5.4
CVE-2026-10770
MEDIUM
Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042
CVSS 6.1
CVE-2026-10769
MEDIUM
Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041
CVSS 5.4
CVE-2026-57214
MEDIUM
RabbitMQ: Stored XSS in RabbitMQ management UI
CVSS 5.4
CVE-2026-57213
MEDIUM
RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering
CVSS 4.8
CVE-2026-55879
CRITICAL
OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover
CVSS 9.3
CVE-2026-55665
HIGH
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
CVE-2026-55659
HIGH
Grist: XSS through unsafe value interpolation in server-rendered pages
CVSS 7.7
Details
Vulnerabilities
45,771
Exploit Likelihood
High