CWE-87 · Cross-site Scripting
Improper Neutralization of Alternate XSS Syntax
49CVEs
0exploited
5with a public check
0likely (EPSS 10%+)
SortMost likely exploited
49 CVEs with CWE-87 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-35161CheckXWiki >= 6.2-milestone-1 - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 9.7 · 2023-06-23 | 9.7 | 2.4% | 2023-06-23 |
| CVE-2023-35160CheckXWiki >= 2.5-milestone-2 - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 9.7 · 2023-06-23 | 9.7 | 2.3% | 2023-06-23 |
| CVE-2023-35159CheckXWiki >= 3.4-milestone-1 - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 9.7 · 2023-06-23 | 9.7 | 2.2% | 2023-06-23 |
| CVE-2023-35156CheckXWiki >= 6.0-rc-1 - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 9.7 · 2023-06-23 | 9.7 | 2.1% | 2023-06-23 |
| CVE-2023-35158CheckXWiki - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 9.7 · 2023-06-23 | 9.7 | 2.0% | 2023-06-23 |
| CVE-2026-40321DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploaddnnsoftware · Dnn.Platform · CVSS 8.1 · 2026-04-17 | 8.1 | 6.4% | 2026-04-17 |
| CVE-2022-36033jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledjhy · jsoup · CVSS 6.1 · 2022-08-29 | 6.1 | 1.6% | 2022-08-29 |
| CVE-2020-5298Reflected XSS when importing CSV in OctoberCMSoctobercms · october · CVSS 4 · 2020-06-03 | 4.0 | 0.9% | 2020-06-03 |
| CVE-2021-40131Cisco Common Services Platform Collector Stored Cross-Site Scripting VulnerabilityCisco · Cisco Common Services Platform Collector Software · CVSS 5.5 · 2021-11-18 | 5.5 | 0.7% | 2021-11-18 |
| CVE-2022-39295Improper Neutralization of Alternate XSS Syntax in Knowage-ServerKnowageLabs · Knowage-Server · CVSS 6.1 · 2022-10-13 | 6.1 | 0.7% | 2022-10-13 |
| CVE-2026-54002Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`getkirby · kirby · CVSS 8.5 · 2026-07-09 | 8.5 | 0.5% | 2026-07-09 |
| CVE-2022-20963A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)…Cisco · Cisco Identity Services Engine Software · CVSS 5.4 · 2022-11-03 | 5.4 | 0.5% | 2022-11-03 |
| CVE-2025-27793Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]vega · vega · CVSS 5.3 · 2025-03-27 | 5.3 | 0.5% | 2025-03-27 |
| CVE-2026-33506DOM-Based XSS in Ory Polis Login Pageory · polis · CVSS 8.8 · 2026-03-26 | 8.8 | 0.5% | 2026-03-26 |
| CVE-2023-20188A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business…Cisco · Cisco Small Business Smart and Managed Switches · CVSS 4.8 · 2023-06-28 | 4.8 | 0.5% | 2023-06-28 |
| CVE-2023-20208A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based managemen…Cisco · Cisco Identity Services Engine Software · CVSS 4.8 · 2023-11-21 | 4.8 | 0.5% | 2023-11-21 |
| CVE-2024-43381reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoningyogeshojha · rengine · CVSS 5 · 2024-08-16 | 5.0 | 0.4% | 2024-08-16 |
| CVE-2025-54369Node-SAML SAML Authentication Bypassnode-saml · node-saml · CVSS 9.3 · 2025-12-12 | 9.3 | 0.4% | 2025-12-12 |
| CVE-2026-25688Apache Answer: XSS in AI Answer RenderingApache Software Foundation · Apache Answer · CVSS 6.1 · 2026-06-09 | 6.1 | 0.4% | 2026-06-09 |
| CVE-2026-55661TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemestinacms · tinacms · CVSS 4.8 · 2026-07-01 | 4.8 | 0.4% | 2026-07-01 |
| CVE-2024-8505WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameterdcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load · CVSS 6.4 · 2024-10-02 | 6.4 | 0.4% | 2024-10-02 |
| CVE-2026-79946Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerab…Dell · Secure Connect Gateway 5.0 - Application · CVSS 5.3 · 2026-09-09 | 5.3 | 0.4% | 2026-09-09 |
| CVE-2025-14732Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIelemntor · Elementor Website Builder – more than just a page builder · CVSS 6.4 · 2026-04-08 | 6.4 | 0.3% | 2026-04-08 |
| CVE-2024-4459Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titlesthemesflat · Themesflat Addons For Elementor · CVSS 6.4 · 2024-06-06 | 6.4 | 0.3% | 2024-06-06 |
| CVE-2024-25640Improper Neutralization of Alternate XSS Syntax in iris-webdfir-iris · iris-web · CVSS 4.6 · 2024-02-19 | 4.6 | 0.3% | 2024-02-19 |
| CVE-2026-42235n8n: XSS via MCP OAuth clientn8n-io · n8n · CVSS 8.8 · 2026-05-04 | 8.8 | 0.3% | 2026-05-04 |
| CVE-2024-3519Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langdglingren · Media Library Assistant · CVSS 6.1 · 2024-05-21 | 6.1 | 0.3% | 2024-05-21 |
| CVE-2024-2618Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Ultimate Addons for Elementor · CVSS 6.4 · 2024-05-24 | 6.4 | 0.3% | 2024-05-24 |
| CVE-2026-42458Magento LTS: Reflected XSS - Import -> Data Flow (profiles)OpenMage · magento-lts · CVSS 5.3 · 2026-05-15 | 5.3 | 0.3% | 2026-05-15 |
| CVE-2024-3162Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonialjegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for… · CVSS 6.4 · 2024-04-03 | 6.4 | 0.3% | 2024-04-03 |
| CVE-2024-2750Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgettimstrifler · Exclusive Addons for Elementor · CVSS 6.4 · 2024-05-02 | 6.4 | 0.3% | 2024-05-02 |
| CVE-2023-6446Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scriptingcodepeople · Calculated Fields Form · CVSS 4.4 · 2024-01-11 | 4.4 | 0.3% | 2024-01-11 |
| CVE-2023-50712Improper Neutralization of Alternate XSS Syntax in iris-webdfir-iris · iris-web · CVSS 4.6 · 2023-12-22 | 4.6 | 0.3% | 2023-12-22 |
| CVE-2025-48366GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsIntermesh · groupoffice · CVSS 6.9 · 2025-05-22 | 6.9 | 0.3% | 2025-05-22 |
| CVE-2026-22711Stored XSS through system messages in WikiLoveThe Wikimedia Foundation · Mediawiki - Wikilove Extension · CVSS 6.9 · 2026-04-07 | 6.9 | 0.3% | 2026-04-07 |
| CVE-2025-48992Group-Office vulnerable to blind XSSIntermesh · groupoffice · CVSS 5.2 · 2025-06-16 | 5.2 | 0.3% | 2025-06-16 |
| CVE-2024-3666Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpopal · Opal Estate Pro – Property Management and Submission · CVSS 6.4 · 2024-05-22 | 6.4 | 0.3% | 2024-05-22 |
| CVE-2024-2657Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingkhl32 · Font Farsi · CVSS 4.4 · 2024-05-30 | 4.4 | 0.3% | 2024-05-30 |
| CVE-2026-33510DOM-Based XSS in Homarr /auth/login Redirecthomarr-labs · homarr · CVSS 8.8 · 2026-04-06 | 8.8 | 0.2% | 2026-04-06 |
| CVE-2025-8561Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeovatheme · Ova Advent · CVSS 6.4 · 2025-10-15 | 6.4 | 0.2% | 2025-10-15 |
| CVE-2026-55237AutoGPT SignUp Page has DOM-Based XSS and Open RedirectSignificant-Gravitas · AutoGPT · CVSS 8.8 · 2026-06-18 | 8.8 | 0.2% | 2026-06-18 |
| CVE-2026-85293InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsInvoicePlane · InvoicePlane · CVSS 4.8 · 2026-09-25 | 4.8 | 0.2% | 2026-09-25 |
| CVE-2026-34598YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"YesWiki · yeswiki · CVSS 7.1 · 2026-04-02 | 7.1 | 0.2% | 2026-04-02 |
| CVE-2026-45314Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/imageopen-webui · open-webui · CVSS 7.4 · 2026-05-15 | 7.4 | 0.2% | 2026-05-15 |
| CVE-2025-65961Contao is vulnerable to cross-site scripting in templatescontao · contao · CVSS 3.3 · 2025-11-25 | 3.3 | 0.2% | 2025-11-25 |
| CVE-2025-48076Galette is vulnerable to Cross-site Scriptinggalette · galette · CVSS 5.3 · 2025-11-04 | 5.3 | 0.2% | 2025-11-04 |
| CVE-2025-48494Gokapi vulnerable to stored XSS via uploading file with malicious file nameForceu · Gokapi · CVSS 4.8 · 2025-06-02 | 4.8 | 0.2% | 2025-06-02 |
| CVE-2026-35534ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionChurchCRM · CRM · CVSS 7.6 · 2026-04-07 | 7.6 | 0.2% | 2026-04-07 |
| CVE-2025-48495Gokapi has stored XSS vulnerability in friendly name for API keysForceu · Gokapi · CVSS 4.8 · 2025-06-02 | 4.8 | 0.1% | 2025-06-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.