CWE-84

22 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 0High 2Medium 19Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2026-96654
Plex Media Server URL injection
Plex · Media Server
ExploitedMedium6.9

CVE-2026-96654
Plex Media Server URL injection
Plex · Media Server
ExploitedMedium6.9
CVE-2026-88859
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
Red Hat · Red Hat Enterprise Linux 6
Medium6.3
CVE-2026-67338
JupyterLab before 4.5.9 Stored XSS via Extension Manager
jupyterlab · jupyterlab
Medium5.1
CVE-2026-54443
Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
lissy93 · dashy
Medium5.9
CVE-2025-58444
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
modelcontextprotocol · inspector
High8.6
CVE-2024-52890
IBM Engineering Lifecycle Optimization - Publishing cross-site scripting
IBM · IBM Engineering Lifecycle Optimization - Publishing
Medium6.1
CVE-2025-30203
Tuleap allows XSS via the content of RSS feeds in the RSS widgets
Enalean · tuleap
Medium4.8
CVE-2025-25334
An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.
Product not named
Medium5.5
CVE-2025-25331
An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
Product not named
Medium5.5
CVE-2025-25330
An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
Product not named
Medium5.5