CWE-79
High likelihoodImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
45,751 vulnerabilities with CWE-79
CVE-2026-15016
MEDIUM
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
CVSS 6.4
CVE-2026-13440
HIGH
Upsell, Bogo, Quick View, Direct Checkout & Side Cart For WooCommerce < 2.1.0 - XSS
CVSS 7.2
CVE-2026-11598
MEDIUM
Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
CVSS 5.0
CVE-2026-8167
MEDIUM
Reflected XSS in theWP's News Theme V8
CVSS 6.1
CVE-2026-44387
MEDIUM
Elecom Co.,ltd. WAB-M1775-PS - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 5.2
CVE-2026-15730
MEDIUM
GamiPress <= 7.9.9.1 - Contributor+ Stored Cross-Site Scripting via heading_size
CVSS 6.4
CVE-2026-14870
HIGH
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
CVSS 7.1
CVE-2026-14819
LOW
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
CVSS 3.5
CVE-2026-17528
MEDIUM
nice-select2 < 2.4.1 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 6.1
CVE-2026-65448
MEDIUM
WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
CVSS 6.5
CVE-2026-65447
HIGH
WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65446
HIGH
WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65443
HIGH
WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65441
HIGH
WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65440
HIGH
WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65439
HIGH
WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65438
HIGH
WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-65437
HIGH
WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-61957
HIGH
WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
CVSS 7.1
CVE-2026-51565
MEDIUM
Milk admin <= 0.9.8 - Cross-Site Scripting via DocsController action Parameter
CVSS 6.1
CVE-2026-53668
MEDIUM
React Router - Open Redirect to Cross-Site Scripting
CVSS 6.9
CVE-2026-53667
MEDIUM
React Router RSCErrorHandler - Cross-Site Scripting
CVSS 6.9
CVE-2026-66825
MEDIUM
Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links
CVE-2026-66824
CRITICAL
Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
CVE-2026-59729
MEDIUM
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Details
Vulnerabilities
45,751
Exploit Likelihood
High