CWE-79: Cross-site Scripting vulnerabilities

10,711 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.2%	CVE-2026-104670LearnPress (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104670 Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. EPSS 0.2%Vulnerability ThimPress CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-104394Charitable (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. EPSS 0.2%Vulnerability Syed Balkhi CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-94675Fluent Forms Pro Add On Pack (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-94675 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. EPSS 0.2%Vulnerability Fluent Forms Free vs Pro CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-42636WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-42636 Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-42635WooCommerce Simple Auctions (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-42635 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. EPSS 0.2%Vulnerability wpgenie CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-42634Video Background Block (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-42634 Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. EPSS 0.2%Vulnerability bPlugins CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-42418Social Rocket (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-42418 Social Rocket versions prior to 1.3.6 contain a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser. The issue affects all versions from 0 up to 1.3.5 inclusive. The vulnerability has a high severity rating with a CVSS score of 7.1. EPSS 0.2%Vulnerability Socialrocket CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-40807CF7 Views – Complete Entry Management for Contact Form 7 (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-40807 Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions. EPSS 0.2%Vulnerability Aman CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-40806Blog, Posts and Category Filter for Elementor (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-40806 Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions. EPSS 0.2%Vulnerability Plugin Devs CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39790VikRentCar (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39790 A Reflected Cross-site Scripting (XSS) vulnerability exists in VikRentCar through version 1.4.7. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1. EPSS 0.2%Vulnerability e4jvikwp CWE-79	CVE Database V5	2026-10-06
Medium	6.5	EPSS 0.2%	CVE-2026-39788Front End PM (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39788 Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. EPSS 0.2%Vulnerability Shamim Hasan CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39784Hotel Booking (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39784 Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. EPSS 0.2%Vulnerability nicdark CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39781Document Gallery (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39781 CVE-2026-39781 is a high-severity reflected cross-site scripting (XSS) vulnerability in Dan Rossiter Document Gallery up to version 5.1.1. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in a victim's browser. The vulnerability affects versions from 0 through 5.1.1. No official patch or remediation information is provided in the available data. EPSS 0.2%Vulnerability Dan Rossiter CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39778Ansar Import (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39778 Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions. EPSS 0.2%Vulnerability themeansar CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39766ARForms (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39766 Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. EPSS 0.2%Vulnerability reputeinfosystems CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39758Midtrans-WooCommerce (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39758 Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39750StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39750 Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions. EPSS 0.2%Vulnerability weDevs CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39748EduMall (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39748 Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. EPSS 0.2%Vulnerability ThemeMove CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39745Contact Form to DB by BestWebSoft (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39745 Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. EPSS 0.2%Vulnerability bestweblayout CWE-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-39731Database for CF7 (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-39731 Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. EPSS 0.2%Vulnerability code4life CWE-79	CVE Database V5	2026-10-06

Page 48 of 540