CWE-87

57 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 6High 12Medium 38Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
InvoicePlane · InvoicePlane
Medium4.8
CVE-2026-79946
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate…
Dell · Secure Connect Gateway 5.0 - Application
Medium5.3
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
getkirby · kirby
High8.5
CVE-2026-55661
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
tinacms · tinacms
Medium4.8
CVE-2026-55237
AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
Significant-Gravitas · AutoGPT
High8.8
CVE-2026-46492
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
commenthol · md-fileserver
High7.2
CVE-2026-25688
Apache Answer: XSS in AI Answer Rendering
Apache Software Foundation · Apache Answer
Medium6.1
CVE-2026-45314
Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
open-webui · open-webui
High7.4
CVE-2026-42458
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
OpenMage · magento-lts
Medium5.3
CVE-2026-42235
n8n: XSS via MCP OAuth client
n8n-io · n8n
High8.8