CVE Daily
← All tags

Tag: Stored XSS

All CVEs associated with "Stored XSS". Page 1/1 • 83 CVEs.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0
2025-08-14
Medium

CVE-2025-55714

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor allows Stored XSS. This issue affects JetElements For Elemen…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-55713

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeThemes Blocksy allows Stored XSS. This issue affects Blocksy: from n/a through 2.1.6.

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-55711

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder allows Stored XSS. This issue affects WP Table Builder: from n/…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-55709

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Comp…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54749

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery allows Stored XSS. This issue affects JetProductGallery: from n/a th…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54746

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect allows Stored XSS. This issue affects Shortcode Redirect: from n/a th…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54740

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog allows Stored XSS. This issue affects Print My Blog: from n/a throug…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54729

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking allows Stored XSS. This issue affects Webba Booking: from…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-54727

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Stored XSS. This issue affects CM O…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-54054

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List allows Stored XSS. This issue affects 12 Step Meeting List: f…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53582

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift allows Stored XSS. This issue affects WordLift: from n/a through 3.54.5.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53581

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro allows Stored XSS. This issue affects RSS Feed Pro: from n/a through 1.1…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-53342

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize allows Stored XSS. This issue affects Modernize: from n/a through 3.4.0.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53330

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals allows Stored XSS. This issue affects WP Rentals: from n/a through 3.13.1.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-52771

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bcupham Video Expander allows Stored XSS. This issue affects Video Expander: from n/a through 1.0.

CVSS: 6.5 CWE: CWE-79
Read more
High

CVE-2025-52765

Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin allows Stored XSS. This issue affects NetInsight Analytics Implementation Plugin: from n/a throu…

CVSS: 7.1 CWE: CWE-352
Read more
Medium

CVE-2024-37945

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addon…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54699

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS allows Stored XSS. This issue affects Masteriyo - LMS: from n/a through…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54696

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels allows Stored XSS. This issue affects WPFunnels: from n/a through 3.5.26.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54688

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.7.1.2.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54684

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact allows Stored XSS. This issue affec…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-54680

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sparkle Themes Blogger Buzz allows Stored XSS. This issue affects Blogger Buzz: from n/a through…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54676

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS. This issue a…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54668

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred allows Stored XSS. This issue affects myCred: from n/a through 2.9.4.3.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-52730

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin allows Stored XSS. This…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-50040

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets allows Stored XSS. This issue affects CF7 Spreadsheets: from n/a throu…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-49437

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in worstguy WP LOL Rotation allows Stored XSS. This issue affects WP LOL Rotation: from n/a through…

CVSS: 6.5 CWE: CWE-79
Read more
High

CVE-2025-49065

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter allows Stored XSS. This issue affects Visit Counter: from n/a throu…

CVSS: 7.1 CWE: CWE-79
Read more
Medium

CVE-2025-49061

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perteus Porn Videos Embed allows Stored XSS. This issue affects Porn Videos Embed: from n/a throu…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-49053

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager allows Stored XSS. This issue affects WP Airdrop Manager: from n/a…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-49051

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biscia7 Hide Text Shortcode allows Stored XSS. This issue affects Hide Text Shortcode: from n/a t…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-49048

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inspectlet Inspectlet – User Session Recording and Heatmaps allows Stored XSS. This issue a…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-49047

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync allows Stored XSS. This issue affects DigitalOcean Spaces Sync:…

CVSS: 5.9 CWE: CWE-79
Read more
High

CVE-2025-49044

Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll allows Stored XSS. This issue affects Simple Poll: from n/a through 1.1.1.

CVSS: 7.1 CWE: CWE-352
Read more
Medium

CVE-2025-47610

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wetail WooCommerce Fortnox Integration allows Stored XSS. This issue affects WooCommerce Fortnox…

CVSS: 6.5 CWE: CWE-79
Read more
2025-08-08
High

CVE-2020-9322

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account…

CVSS: 8.8 CWE: CWE-79
Read more
2025-08-06
Medium

CVE-2025-20331

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. T…

CVSS: 5.4 CWE: CWE-80
Read more
2025-08-05
Low

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version 8 was not affected. A rogue admin could set up a malicious folder containing XS…

CVSS: 2.0 CWE: CWE-20
Read more
2025-08-02
Medium

CVE-2025-6078

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, ma…

CVSS: 5.4 CWE: N/A
Read more
2025-07-29
Medium

CVE-2025-27514

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a…

CVSS: 4.5 CWE: CWE-79
Read more
2025-07-28
Critical

CVE-2025-54299

A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.

CVSS: 9.4 CWE: CWE-79
Read more
Critical

CVE-2025-54298

A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.

CVSS: 9.4 CWE: CWE-79
Read more
2025-07-25
Medium

CVE-2025-5254

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS.This issue affects Kron PAM: before 3.7.

CVSS: 6.1 CWE: CWE-79
Read more
2025-07-23
High

CVE-2025-54297

A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.

CVSS: 7.0 CWE: CWE-79
Read more
High

CVE-2025-54296

A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.

CVSS: 7.0 CWE: CWE-79
Read more
2025-07-21
Medium

CVE-2025-41681

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.

CVSS: 4.8 CWE: CWE-79
Read more
2025-07-18
Medium

CVE-2025-50126

A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] pa…

CVSS: 5.3 CWE: CWE-79
Read more
Medium

CVE-2025-50058

A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply…

CVSS: 5.1 CWE: CWE-79
Read more
High

CVE-2025-49486

A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.

CVSS: 8.6 CWE: CWE-79
Read more
2025-07-16
Medium

CVE-2025-53924

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web scrip…

CVSS: 6.9 CWE: CWE-79
Read more
High

CVE-2025-48291

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery allows Stored XSS. This issue affects…

CVSS: 7.1 CWE: CWE-79
Read more
Medium

CVE-2025-54051

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block allows Stored XSS. This issue affects LightBox Block: from n/a through 1.…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54050

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor allows Stored XSS. This issue affects Responsive Addo…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54013

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nanbu Welcart e-Commerce allows Stored XSS. This issue affects Welcart e-Commerce: from n/a throu…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2025-54009

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters allows Stored XSS. This issue affects JetSmartFilters: from n/a throug…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-54006

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder allows Stored XSS. This issue affects Bold Page Builder: from n/a th…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53996

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch allows Stored XSS. This issue affects JetSearch: from n/a through 3.5.10.1.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53995

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup allows Stored XSS. This issue affects JetPopup: from n/a through 2.0.15.1.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53991

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 1.5.4.1.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53989

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Stored XSS. This issue affects JetBlocks For Elementor:…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53984

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs allows Stored XSS. This issue affects JetTabs: from n/a through 2.2.9.

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-53982

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor allows Stored XSS. This issue affects JetElements For Elemen…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-48295

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons allows Stored XSS. This issue affects Easy Elementor Addons: fro…

CVSS: 6.5 CWE: CWE-79
Read more
Medium

CVE-2025-48156

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall allows Stored XSS. This issue affects Image Wall: from n/a through 3.1.

CVSS: 6.5 CWE: CWE-79
Read more
High

CVE-2025-48153

Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images allows Stored XSS. This issue affects Import CDN-Remote Images: from n/a through 2.1.2.

CVSS: 7.1 CWE: CWE-352
Read more
2025-07-15
Medium

CVE-2025-7672

The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: from 4.0.0.01 before 4.6.0.23.

CVSS: 4.3 CWE: CWE-79
Read more
2025-06-15
High

CVE-2025-5990

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

CVSS: 7.6 CWE: CWE-79
Read more
2025-06-05
Medium

CVE-2025-30084

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized befo…

CVSS: 6.1 CWE: CWE-79
Read more
2025-06-04
Medium

CVE-2025-20279

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerab…

CVSS: 4.8 CWE: CWE-79
Read more
2025-05-19
Medium

CVE-2025-48253

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce allows Stored XSS. Thi…

CVSS: 6.5 CWE: CWE-79
Read more
2025-05-07
Medium

CVE-2025-20147

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scr…

CVSS: 5.4 CWE: CWE-79
Read more
2025-03-20
High

CVE-2024-10819

A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without their consent, exploiting their session.…

CVSS: 8.8 CWE: CWE-352
Read more
2025-02-26
Medium

CVE-2025-20116

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have v…

CVSS: 4.8 CWE: CWE-79
Read more
2025-02-24
High

CVE-2025-26529

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

CVSS: 8.3 CWE: CWE-79
Read more
Low

CVE-2025-26528

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

CVSS: 3.4 CWE: CWE-79
Read more
2025-01-24
Medium

CVE-2025-24731

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker allows Stored XSS. This issue affects Download I…

CVSS: 5.9 CWE: CWE-79
Read more
2025-01-23
Medium

CVE-2024-57329

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaSc…

CVSS: 5.4 CWE: CWE-79
Read more
2024-11-18
Medium

CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The de…

CVSS: 5.4 CWE: CWE-79
Read more
2024-08-01
Medium

CVE-2024-39648

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.

CVSS: 5.9 CWE: CWE-79
Read more
2024-07-22
Medium

CVE-2024-37100

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mayur Somani, threeroutes media Elegant Themes Icons allows Stored XSS.This issue affects…

CVSS: 6.5 CWE: CWE-79
Read more
2024-07-21
Medium

CVE-2024-37507

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 3.3.57.

CVSS: 6.5 CWE: CWE-79
Read more
2024-06-18
Medium

CVE-2024-38274

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

CVSS: 6.1 CWE: CWE-79
Read more
2021-04-05
Medium

CVE-2021-24211

The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to ex…

CVSS: 5.4 CWE: CWE-79
Read more