ByteOS

Product

Mediawiki - Apex skin

Default Status

unaffected

Versions

Affected

From 1.39.x before 1.39.9 (semver)
From 1.41.x before 1.41.3 (semver)
From 1.42.x before 1.42.2 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Impacts

CAPEC ID	Description
CAPEC-592	CAPEC-592 Stored XSS

CAPEC ID: CAPEC-592

Description: CAPEC-592 Stored XSS

Credits

finder

R4356th

References

Hyperlink	Resource
https://phabricator.wikimedia.org/T368628	N/A
https://phabricator.wikimedia.org/T370081	N/A
https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7	N/A

Hyperlink: https://phabricator.wikimedia.org/T368628

Resource: N/A

Hyperlink: https://phabricator.wikimedia.org/T370081

Resource: N/A

Hyperlink: https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Vendor

Product

mediawiki-apex_skin

CPEs

cpe:2.3:a:wikimedia:mediawiki-apex_skin:*:*:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 1.39.0 before 1.39.9 (semver)
From 1.41.0 before 1.41.3 (semver)
From 1.42.0 before 1.42.2 (semver)

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Published At:05 Oct, 2024 | 01:15

Updated At:16 Oct, 2024 | 16:44

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Primary

Version: 3.1

Base score: 4.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CPE Matches

cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*

>>apex>>Versions from 1.13.0(inclusive) to 1.39.9(exclusive)

cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*

>>apex>>Versions from 1.41.0(inclusive) to 1.41.3(exclusive)

cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*

>>apex>>Versions from 1.42.0(inclusive) to 1.42.2(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

References

Hyperlink	Source	Resource
https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	Patch
https://phabricator.wikimedia.org/T368628	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	Issue Tracking Vendor Advisory
https://phabricator.wikimedia.org/T370081	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	Exploit Issue Tracking Vendor Advisory

Hyperlink: https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Resource:

Patch

Hyperlink: https://phabricator.wikimedia.org/T368628

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Resource:

Issue Tracking

Vendor Advisory

Hyperlink: https://phabricator.wikimedia.org/T370081

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Resource:

Exploit

Issue Tracking

Vendor Advisory

Similar CVEs

3556Records found

CVE-2024-47847

Matching Score-10

Matching Score-10

CVSS Score-6.9||MEDIUM

EPSS-1.06% / 77.85%

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:47

Updated-16 Oct, 2024 | 16:42

Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Product-cargo Mediawiki - Cargo mediawiki-cargo

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-61638

Matching Score-10

Matching Score-10

CVSS Score-Not Assigned

EPSS-0.01% / 0.56%

7 Day CHG~0.00%

Published-02 Feb, 2026 | 23:52

Updated-16 Mar, 2026 | 18:34

Sanitizer::validateAttributes data-XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

Product-mediawiki parsoid Parsoid MediaWiki

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47846

Matching Score-8

Matching Score-8

CVSS Score-6.9||MEDIUM

EPSS-0.54% / 67.66%

7 Day CHG~0.00%

Published-05 Oct, 2024 | 00:39

Updated-16 Oct, 2024 | 16:42

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Product-cargo Mediawiki - Cargo mediawiki-cargo

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2024-47841

Matching Score-8

Matching Score-8

CVSS Score-6.9||MEDIUM

EPSS-28.91% / 96.61%

7 Day CHG~0.00%

Published-05 Oct, 2024 | 01:02

Updated-16 Oct, 2024 | 16:34

Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

Product-wikimedia-extensions-css Mediawiki - CSS Extension mediawiki-extensions-css

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2020-36324

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.28%

7 Day CHG~0.00%

Published-21 Apr, 2021 | 19:43

Updated-04 Aug, 2024 | 17:23

Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.

Product-analytics-quarry-web n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-39935

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.07% / 20.74%

7 Day CHG+0.01%

Published-07 Apr, 2026 | 22:04

Updated-08 Apr, 2026 | 23:16

XSS-via-i18n in localised wiki names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

Product-Mediawiki - CampaignEvents Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-39936

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.07% / 20.74%

7 Day CHG+0.01%

Published-07 Apr, 2026 | 22:11

Updated-08 Apr, 2026 | 23:16

Stored XSS in Score due to usage of non-reserved data attributes

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Product-Mediawiki - Score Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-39933

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.07% / 20.74%

7 Day CHG+0.01%

Published-07 Apr, 2026 | 21:51

Updated-08 Apr, 2026 | 22:16

Multiple XSS vulnerabilities in GlobalWatchlist

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Product-Mediawiki - GlobalWatchlist Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-22714

Matching Score-6

Matching Score-6

CVSS Score-2.3||LOW

EPSS-0.03% / 7.69%

7 Day CHG~0.00%

Published-08 Jan, 2026 | 23:56

Updated-13 Jan, 2026 | 14:03

i18n XSS, DoS and config SQLI in Monaco

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.

Product-Mediawiki - Monaco Skin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-22710

Matching Score-6

Matching Score-6

CVSS Score-2.3||LOW

EPSS-0.01% / 3.14%

7 Day CHG~0.00%

Published-08 Jan, 2026 | 23:48

Updated-12 Feb, 2026 | 17:50

Stored XSS through autocomment system messages in Wikibase

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.

Product-wikibase Mediawiki - Wikibase Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-22713

Matching Score-6

Matching Score-6

CVSS Score-2.3||LOW

EPSS-0.01% / 3.14%

7 Day CHG~0.00%

Published-09 Jan, 2026 | 00:00

Updated-12 Feb, 2026 | 17:47

Stored XSS through edit summaries in GrowthExperiments

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.

Vendor-growth Wikimedia Foundation

Product-growthexperiments Mediawiki - GrowthExperiments Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-11937

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 05:14

Updated-21 Oct, 2025 | 19:31

Stored XSS through a system message in SecurePoll

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

Product-Mediawiki - SecurePoll Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19328

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.53% / 67.42%

7 Day CHG~0.00%

Published-27 Nov, 2019 | 15:28

Updated-05 Aug, 2024 | 02:16

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

Product-wikidata_query_gui n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19329

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.34% / 56.86%

7 Day CHG~0.00%

Published-27 Nov, 2019 | 15:28

Updated-05 Aug, 2024 | 02:16

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

Product-wikidata_query_gui n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-25065

Matching Score-6

Assigner-VulDB

Matching Score-6

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-0.24% / 47.79%

7 Day CHG~0.00%

Published-05 Jan, 2023 | 09:17

Updated-10 Apr, 2025 | 14:16

Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting

A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability.

Product-mediawiki-extensions-i18ntags mediawiki-extensions-I18nTags

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-0671

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-0.07% / 20.28%

7 Day CHG+0.02%

Published-08 Jan, 2026 | 16:21

Updated-15 Jan, 2026 | 21:50

Multiple stored i18n/message-key XSSes in UploadWizard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.

Product-mediawiki-extensions-uploadwizard MediaWiki - UploadWizard extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-30458

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.37% / 58.96%

7 Day CHG~0.00%

Published-09 Apr, 2021 | 06:06

Updated-03 Aug, 2024 | 22:32

An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.

Product-parsoid n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19327

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.53% / 67.42%

7 Day CHG~0.00%

Published-27 Nov, 2019 | 15:28

Updated-05 Aug, 2024 | 02:16

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

Product-wikidata_query_gui n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62670

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:29

Updated-21 Oct, 2025 | 19:31

Stored XSS through a system message in FlexDiagrams

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.

Product-Mediawiki - FlexDiagrams Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62701

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 04:45

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.

Product-Mediawiki - Wikistories

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62654

Matching Score-6

Matching Score-6

CVSS Score-2||LOW

EPSS-0.04% / 12.38%

7 Day CHG~0.00%

Published-17 Oct, 2025 | 22:38

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in QuizGame

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44.

Product-MediaWiki QuizGame extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62663

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:16

Updated-21 Oct, 2025 | 19:31

Stored XSS through a system message in UploadWizard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.

Product-Mediawiki - UploadWizard Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62693

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-20 Oct, 2025 | 17:51

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in LastModified

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39.

Product-Mediawiki - LastModified Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62695

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 04:02

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.

Product-Mediawiki - WikiLambda Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62653

Matching Score-6

Matching Score-6

CVSS Score-2||LOW

EPSS-0.04% / 12.38%

7 Day CHG~0.00%

Published-17 Oct, 2025 | 22:23

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in PollNY

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44.

Product-MediaWiki PollNY extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62662

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:19

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in AdvancedSearch

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.

Product-Mediawiki - AdvancedSearch Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62700

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-20 Oct, 2025 | 17:53

Updated-21 Oct, 2025 | 19:31

Stored XSS through a system message in MultiBoilerplate

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before 1.39.

Product-Mediawiki - MultiBoilerplate Extensionmaste

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62667

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:42

Updated-21 Oct, 2025 | 19:31

Stored XSS through article extracts in GrowthExperiments

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

Product-Mediawiki - GrowthExperiments Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62659

Matching Score-6

Matching Score-6

CVSS Score-2.1||LOW

EPSS-0.05% / 17.02%

7 Day CHG~0.00%

Published-22 Oct, 2025 | 15:31

Updated-22 Oct, 2025 | 21:12

The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0.

Product-MediaWiki CookieConsent extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62656

Matching Score-6

Matching Score-6

CVSS Score-5.8||MEDIUM

EPSS-0.04% / 11.37%

7 Day CHG~0.00%

Published-20 Oct, 2025 | 20:15

Updated-21 Oct, 2025 | 19:31

GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking extension allows Stored XSS.This issue affects MediaWiki GlobalBlocking extension: 1.43, 1.44.

Product-MediaWiki GlobalBlocking extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62694

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.23%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 04:28

Updated-21 Oct, 2025 | 20:20

Stored XSS through a system message

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.

Product-Mediawiki - WikiLove Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62664

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:13

Updated-21 Oct, 2025 | 19:31

Stored XSS through a system message in ImageRating

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.

Product-Mediawiki - ImageRating Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62671

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.39%

7 Day CHG~0.00%

Published-18 Oct, 2025 | 04:24

Updated-21 Oct, 2025 | 19:31

Stored XSS through wikitext in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.

Product-Mediawiki - Cargo Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62698

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-20 Oct, 2025 | 18:07

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in ExternalGuidance

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.

Product-Mediawiki - ExternalGuidance

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62657

Matching Score-6

Matching Score-6

CVSS Score-5.8||MEDIUM

EPSS-0.04% / 11.37%

7 Day CHG~0.00%

Published-20 Oct, 2025 | 20:19

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages in PageForms

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44.

Product-MediaWiki PageForms extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62652

Matching Score-6

Matching Score-6

CVSS Score-5.8||MEDIUM

EPSS-0.06% / 18.23%

7 Day CHG~0.00%

Published-17 Oct, 2025 | 22:15

Updated-21 Oct, 2025 | 19:31

Stored XSS in WebAuthn key name

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44.

Product-MediaWiki WebAuthn extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62702

Matching Score-6

Matching Score-6

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 17.15%

7 Day CHG~0.00%

Published-21 Oct, 2025 | 04:42

Updated-21 Oct, 2025 | 19:31

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.

Product-Mediawiki - PageTriage Extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49758

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.07% / 22.20%

7 Day CHG~0.00%

Published-15 Nov, 2024 | 15:17

Updated-20 Nov, 2024 | 14:40

LibreNMS has a stored XSS in ExamplePlugin with Device's Notes

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Notes, its will be trigger. This vulnerability is fixed in 24.10.0.

Vendor-LibreNMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-3996

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.8||MEDIUM

EPSS-0.16% / 36.69%

7 Day CHG~0.00%

Published-28 Apr, 2025 | 02:00

Updated-28 May, 2025 | 15:16

TOTOLINK N150RT MAC Filtering Page home.htm cross site scripting

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home.htm of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Vendor-TOTOLINK

Product-n150rt_firmware n150rt N150RT

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-4959

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-4.8||MEDIUM

EPSS-0.15% / 35.22%

7 Day CHG~0.00%

Published-26 Jun, 2024 | 06:00

Updated-30 Apr, 2025 | 23:27

Frontend Checklist <= 2.3.2 - Admin+ Stored XSS via Items

The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Vendor-j-breuer Unknown jonas_breuer

Product-frontend_checklist Frontend Checklist frontend_checklist

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49764

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.90% / 75.89%

7 Day CHG~0.00%

Published-15 Nov, 2024 | 15:27

Updated-20 Nov, 2024 | 14:40

LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This vulnerability results in the execution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain. This vulnerability is fixed in 24.10.0.

Vendor-LibreNMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49696

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 36.20%

7 Day CHG~0.00%

Published-24 Oct, 2024 | 12:29

Updated-11 May, 2026 | 21:17

WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through <= 3.2.21.

Vendor-robosoft robosoft

Product-robo_gallery Robo Gallery

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-4970

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.32% / 55.42%

7 Day CHG~0.00%

Published-21 Jun, 2024 | 06:00

Updated-18 Mar, 2025 | 15:15

Widget Bundle <= 2.0.0 - Admin+ Stored XSS

The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Vendor-devnath_verma Unknown

Product-widget_bundle Widget Bundle

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-4942

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-4.4||MEDIUM

EPSS-0.19% / 40.06%

7 Day CHG~0.00%

Published-06 Jun, 2024 | 02:02

Updated-08 Apr, 2026 | 17:18

Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Vendor-imarun dextorlobo

Product-custom_dash Custom Dash

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-48870

Matching Score-4

Assigner-JPCERT/CC

Product-mx-m6050 bp-c542wd_firmware mx-5110n_firmware mx-c381_firmware mx-m6070_a bp-b547wd mx-m365n_a_firmware mx-3570n_firmware mx-m6071_firmware bp-60c36_firmware bp-70m31 bp-90c80 bp-c533wd_firmware mx-c400p_firmware mx-3101n mx-4070n_a_firmware mx-3070v_a mx-m3571_firmware mx-m3571 mx-2651_firmware mx-m464n_firmware mx-m2651 mx-5070v_firmware mx-3111u mx-b355wz_firmware mx-4140n mx-4060v_firmware bp-b550wd mx-5140n_firmware mx-m5051 mx-3050v_a mx-b376w_firmware mx-2600g mx-c303wh_firmware bp-70c55_firmware mx-2601n mx-m564n_a mx-b376wh mx-4071s_firmware mx-3550v_firmware mx-m3071_firmware mx-b456wh mx-m356uv mx-c311 mx-m904 bp-50c26 mx-m753u_firmware mx-m264u e-studio1058_firmware mx-2640nr mx-m315n mx-b400p mx-2314nr bp-30c25z_firmware mx-3550n_firmware dx-c401_j_firmware mx-m315u_firmware mx-c303 mx-2610n mx-m316nv mx-m314n mx-m4070_a mx-b476wh_firmware mx-m6070_firmware bp-30m28t_firmware mx-m4070 mx-m453u_firmware mx-m1206_firmware mx-m265nv_firmware mx-m3070_firmware mx-3100g mx-m265ne_firmware mx-c401_firmware mx-m315uv_firmware mx-3070v_firmware mx-b355wt_firmware mx-m1055 bp-c535wr mx-m623u mx-2610n_firmware mx-m264u_firmware mx-m314nr_firmware mx-7040n mx-3571s mx-m4071s_firmware mx-m3551 bp-70c55 mx-m354n_firmware mx-c312_firmware mx-4111n_firmware e-studio908_firmware mx-c380 mx-m265uv mx-c402sc_firmware bp-90c80_firmware dx-c400 mx-b356wh mx-m315ne_firmware mx-1810u mx-6050v_firmware mx-4070v_firmware mx-m754n mx-2615n_firmware bp-70m75_firmware mx-2615n mx-4071s mx-5000n mx-c303w_firmware dx-c400_firmware mx-6580n mx-c304wh_firmware mx-m365n_a bp-50c65_firmware mx-m7570 mx-3060n mx-3610nr mx-b376w mx-7081_firmware bp-70m36_firmware bp-50c55_firmware mx-3110n mx-m1205 mx-b402p mx-m4050_firmware mx-c382sc mx-c310_firmware mx-m503n mx-3115n mx-m565n mx-3070v_a_firmware dx-2000u_firmware mx-m1056 mx-m3551_firmware mx-m3051_firmware mx-m264nr_firmware mx-m453n mx-c303wh mx-2630n mx-m6071 mx-c380p_firmware mx-3050n_a bp-70c65 bp-30c25t bp-60c31_firmware bp-70c36_firmware mx-4051 mx-m364n mx-3061 mx-5112n mx-b402sc mx-7500n_firmware mx-m356uv_firmware mx-3101n_firmware mx-b382p_firmware mx-m3550_firmware mx-4110n_firmware mx-b382sc mx-3116n_firmware mx-m654n bp-b537wr_firmware mx-m354u bp-50c36 mx-2601n_firmware mx-b382_firmware mx-3640n_firmware mx-m6070 mx-5000n_firmware mx-m3571s_firmware mx-3070n_a mx-3640nr_firmware mx-m3071s mx-m363n_firmware mx-8090n mx-m315uv bp-30m31_firmware mx-2640n_firmware mx-3551_firmware mx-b476w_firmware mx-m314n_firmware mx-6071_firmware mx-m753u mx-3110n_a_firmware mx-b355wz mx-m503u mx-m6051_firmware mx-c301w mx-c381 mx-5071 mx-m2651_firmware mx-5110n e-studio1208_firmware mx-m265v_firmware mx-m264n mx-m363n mx-c304wh mx-2600n_firmware mx-m365n_firmware mx-m6070_a_firmware mx-6050v dx-c381 mx-m5050_firmware mx-3110n_firmware mx-2614n mx-b402_firmware mx-b382p mx-m905 mx-3610nr_firmware mx-m3570_firmware bp-50c31 mx-3561 mx-m1205_firmware mx-2600n mx-4070n_a mx-c382scb_firmware bp-b537wr bp-70c31_firmware mx-m465n_firmware mx-5051_firmware mx-b455w mx-c304w mx-5071s_firmware bp-50m26 mx-4141n bp-50m26_firmware mx-3110n_a bp-50m45 mx-3570v_firmware mx-m4070_a_firmware mx-m265n_firmware mx-m4071s mx-2615_a mx-m564n mx-b382 bp-c542wd mx-m265u mx-c303w mx-m364n_firmware mx-m316nv_firmware bp-70m45 bp-70m75 bp-c535wd mx-6070v_a_firmware dx-c311_firmware bp-30m35_firmware mx-b476wh mx-m503u_firmware mx-m754n_a e-studio1058 mx-3071s_firmware mx-2310u_firmware mx-m354nr mx-m3550 mx-4061s mx-4050n_firmware mx-4060n mx-3561s_firmware bp-60c31 mx-7090n_firmware mx-m314u mx-c380_firmware dx-c311j_firmware mx-4071 mx-7081 mx-m565n_firmware mx-m356u_firmware mx-3140n mx-3561_firmware mx-m453u mx-b476w mx-b381 dx-c311j mx-3560v mx-m363u_firmware mx-b455wz_firmware mx-2616n mx-4101n mx-m5071_firmware mx-6070n_a_firmware mx-4071_firmware mx-2616n_firmware bp-30c25_firmware mx-m356nv_firmware mx-m5050 bp-70m65_firmware mx-m265nv mx-m314nv_firmware mx-m266nv dx-c310_firmware mx-5111n mx-b400p_firmware bp-30m35 mx-8081_firmware mx-3071_firmware bp-30m31t_firmware mx-6580n_firmware mx-2640nr_firmware bp-b540wr mx-m283n mx-m5070_firmware bp-30m28t mx-8090n_firmware bp-c545wd mx-m264nr mx-m316n bp-c533wd mx-1810u_firmware mx-m3071s_firmware mx-4050v_firmware bp-30m31 mx-b355wt mx-3114n mx-2314n mx-5071_firmware mx-b402sc_firmware mx-m465n mx-3111u_firmware mx-c303_firmware mx-m365n mx-4100n_firmware mx-7500n mx-4101n_firmware bp-70m90_firmware bp-90c70 mx-3050n bp-60c36 mx-b455wt_firmware mx-4060n_firmware mx-3070v mx-3050v_a_firmware bp-50c26_firmware mx-3570v mx-c304w_firmware mx-m754n_firmware mx-m465n_a mx-m3050 mx-6050n_firmware mx-3610n_firmware mx-4110n mx-5070n_firmware mx-4140n_a mx-m5070 dx-c401_j mx-m356u bp-50c45_firmware mx-4061_firmware mx-4112n_firmware mx-c382scb mx-3061s mx-m315u mx-3070n_firmware mx-m356nv mx-3571s_firmware mx-3560v_firmware mx-3061_firmware mx-m266nv_firmware bp-30c25 mx-b402 mx-b455w_firmware dx-c311 mx-3571 mx-7580n_firmware mx-m314u_firmware mx-m315nv mx-m265v mx-3100n mx-m1206 mx-7090n mx-c301w_firmware mx-3114n_firmware mx-2600g_firmware bp-30c25y mx-5141n mx-m4051 dx-2500n mx-c301 bp-50c55 mx-c381b mx-2614n_firmware mx-4070n_firmware mx-m3570 mx-m654n_firmware bp-55c26_firmware mx-5050n_firmware mx-5070v mx-3140n_a_firmware mx-m5051_firmware mx-6071s_firmware mx-5051 mx-c400_firmware mx-4061s_firmware mx-3051 mx-b456wh_firmware mx-5141n_firmware mx-b456w e-studio1208 mx-m3070 mx-m4071_firmware mx-3060v_firmware mx-6071 mx-4111n mx-m464n bp-30m35t_firmware mx-m4051_firmware mx-m6071s_firmware mx-3140nr mx-m5071 mx-2615_a_firmware mx-4050n bp-70c31 mx-m3050_firmware mx-m4070_firmware mx-3061s_firmware mx-m314nr mx-3640nr mx-3070n mx-m356n mx-c301_firmware bp-b540wr_firmware mx-m1204 mx-4070v_a mx-m266n_firmware bp-70m65 mx-c380p mx-c304 mx-6500n dx-c401_firmware mx-b356wh_firmware mx-3115n_firmware mx-3551 mx-3050v_firmware mx-2301n bp-70c36 mx-3050n_firmware mx-m6050_firmware mx-m905_firmware mx-3100n_firmware mx-6240n_firmware mx-b401_firmware mx-m4071 bp-c535wd_firmware mx-c400p bp-50c45 mx-m7570_firmware bp-30m31t mx-m3571s mx-4100n mx-8081 mx-2630n_firmware mx-b355w_firmware bp-70m31_firmware mx-4112n bp-50m31 mx-m453n_firmware mx-2301n_firmware mx-3140n_firmware mx-m654n_a_firmware mx-m266n mx-6070n_firmware bp-30c25y_firmware mx-3570n bp-70m55 bp-30m28_firmware mx-m264nv mx-5050v mx-m654n_a mx-4140n_firmware mx-5071s bp-c533wr mx-b455wt mx-m3050_a_firmware mx-3060v mx-5001n mx-c312 mx-m265uv_firmware mx-3140nr_firmware mx-m753n_firmware mx-m3071 mx-4060v bp-55c26 mx-3071s mx-3560n_firmware mx-b455wz mx-2310r mx-m465n_a_firmware bp-c535wr_firmware mx-m315v mx-m316n_firmware bp-50c31_firmware mx-5070n mx-m1056_firmware mx-c304_firmware bp-c545wd_firmware mx-2310u mx-m264nv_firmware bp-50m36_firmware dx-c401 bp-70m90 mx-3610n mx-7580n bp-b550wd_firmware mx-4061 dx-c310 bp-50m45_firmware bp-50m55_firmware mx-6070v_a mx-m363u mx-b401 mx-3140n_a bp-30c25t_firmware mx-2314nr_firmware mx-2310r_firmware mx-3560n bp-50m31_firmware mx-b376wh_firmware bp-70m45_firmware mx-m354n mx-6050n mx-6500n_firmware mx-4050v mx-m2630_a_firmware mx-3050v mx-m315nv_firmware mx-m753n bp-90c70_firmware mx-c311_firmware mx-5111n_firmware mx-3571_firmware mx-m1054_firmware mx-c310 mx-4070v mx-m754n_a_firmware mx-m356n_firmware mx-m265u_firmware mx-m265ne mx-m623u_firmware mx-m2630_a e-studio908 mx-2640n bp-30c25z mx-6240n mx-c401 mx-m623n_firmware mx-m3070_a_firmware mx-m264n_firmware mx-2010u mx-3051_firmware mx-6051 mx-6070n_a mx-b380p_firmware mx-m3051 mx-m5071s_firmware mx-m4050 mx-m2630_firmware bp-b547wd_firmware mx-m3070_a mx-3071 mx-m6051 mx-m265n bp-50m55 mx-m1055_firmware mx-m354u_firmware bp-70c65_firmware bp-60c45 mx-m1054 mx-c382sc_firmware mx-4140n_a_firmware mx-6051_firmware bp-50c36_firmware mx-b456w_firmware mx-5141n_a bp-70c45 bp-30m28 mx-6071s mx-4051_firmware mx-m564n_firmware mx-m315ne mx-4141n_firmware mx-4070v_a_firmware mx-3100g_firmware dx-2500n_firmware dx-2000u mx-b380p bp-50c65 bp-50m50_firmware mx-b356w mx-m503n_firmware mx-b355w mx-5001n_firmware mx-m314nv mx-m1204_firmware mx-2314n_firmware mx-5050n bp-70m55_firmware mx-b381_firmware mx-3550n mx-3070n_a_firmware mx-3640n mx-2651 mx-m2630 mx-2010u_firmware bp-70c45_firmware mx-6070v_firmware mx-4070n bp-30m35t mx-c400 mx-5112n_firmware mx-7040n_firmware bp-60c45_firmware mx-3550v mx-m3050_a mx-5140n mx-b382sc_firmware mx-c381b_firmware mx-m6570_firmware mx-b402p_firmware mx-m283n_firmware mx-b356w_firmware bp-c533wr_firmware dx-c381_firmware bp-70m36 mx-5141n_a_firmware mx-5050v_firmware mx-m564n_a_firmware mx-6070v mx-m6570 mx-c402sc mx-3050n_a_firmware mx-m315n_firmware mx-m354nr_firmware mx-3060n_firmware mx-m5071s bp-50m50 mx-m623n mx-m6071s mx-6070n mx-m904_firmware bp-50m36 mx-3561s mx-m315v_firmware mx-3116n e-STUDIO 1208 e-STUDIO 908 e-STUDIO 1058 Sharp Digital Full-color MFPs and Monochrome MFPs

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.2||MEDIUM

EPSS-0.38% / 59.81%

7 Day CHG~0.00%

Published-25 Oct, 2024 | 06:18

Updated-05 Nov, 2024 | 19:34

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.

Vendor-sharp toshibatec Sharp Corporation Toshiba Tec Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49288

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.19% / 41.16%

7 Day CHG~0.00%

Published-17 Oct, 2024 | 19:11

Updated-28 Apr, 2026 | 16:10

WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.9.1.

Vendor-VillaTheme

Product-woocommerce_email_template_customizer Email Template Customizer for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49392

Matching Score-4

Assigner-Acronis International GmbH

Matching Score-4

Assigner-Acronis International GmbH

CVSS Score-5.7||MEDIUM

EPSS-0.32% / 55.17%

7 Day CHG~0.00%

Published-17 Oct, 2024 | 09:48

Updated-18 Oct, 2024 | 20:10

Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.

Vendor-Acronis (Acronis International GmbH)

Product-cyber_files Acronis Cyber Files cyber_files

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49759

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.55% / 68.00%

7 Day CHG~0.00%

Published-15 Nov, 2024 | 15:26

Updated-20 Nov, 2024 | 14:40

LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.

Vendor-LibreNMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-4954

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-5.5||MEDIUM

EPSS-0.11% / 29.00%

7 Day CHG~0.00%

Published-20 Oct, 2023 | 06:35

Updated-08 Apr, 2026 | 17:16

Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting

The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-plugin pluginbuilders

Product-waiting Waiting: One-click countdowns

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-47524

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.2||HIGH

EPSS-0.04% / 13.18%

7 Day CHG~0.00%

Published-01 Oct, 2024 | 20:30

Updated-19 Dec, 2024 | 15:43

LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. This vulnerability is fixed in 24.9.0.

Vendor-LibreNMS