CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wedevs subscribe2 – form, email subscribers & newsletters Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter 7.2 High
- elightup meta box – wordpress custom fields framework WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- dataease DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting 5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 more WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- everest forms forms, wpeverest everest forms +1 more WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- magepeople inc. wpbookingly WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- crocoblock jetengine WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- realmag777 active woot products tables for woocommerce. 100% free Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute 6.4 Medium
- oxilab flipbox – awesomes flip boxes image overlay Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter 6.4 Medium
- codename065 download manager Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name] 7.2 High
- cozmoslabs translatepress WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability 7.1 High
- e4jvikwp vikbooking hotel booking engine & pms VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter 7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property 5.4 Medium
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonials Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter 4.7 Medium
- quttera threatsign – web malware scanner for wordpress Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header 7.2 High
- osamaesh wp visitor statistics (real time traffic) WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters 7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source 7.2 High
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input 7.2 High
- antoineh football pool Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message 6.4 Medium
- andy moyle church admin Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter 7.2 High
- wpchill modula image gallery – photo grid & video gallery Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter 6.4 Medium
- westguard ws form lite – drag & drop contact form builder WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value 7.2 High
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonials Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain 5.4 Medium
- happyforms pro Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter 7.2 High
- osamaesh wp visitor statistics (real time traffic) WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter 7.2 High
- shapedplugin real testimonials – testimonial slider, collect customer reviews and video testimonials Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter 5.4 Medium
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbot weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute 6.4 Medium
- cbutlerjr wp-members membership plugin WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field 6.4 Medium
- jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta 7.2 High
- mpol wp imageviewer WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute 6.4 Medium
- oxilab image hover effects ultimate ( image gallery, effects, lightbox, comparison & magnifier ) Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Par… 4.9 Medium
- happyforms pro Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header 7.2 High
- faboba falang multilanguage for wordpress Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook 6.4 Medium
- jackdewey link library Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter 7.2 High
- untapwp vidplex WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- aguila technologies wp customer area WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- bdthemes element pack elementor addons WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- bplugins flash & html5 video WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- brainstorm force spectra WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- elementor website builder WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- metaphor creations, llc ditty WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- tomdever wpforo forum wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms 6.4 Medium
- john-dagelmore wpspeed – wordpress speed, cache & performance optimization (core web vitals, pagespeed 100) WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name 6.4 Medium
- dylanjkotze zephyr project manager Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter 5.4 Medium
- liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- markus wiesenhofer contact form 7 – post fields WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- moreconvert mc woocommerce wishlist WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- bootstrapped ventures wp recipe maker WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- wc lovers wcfm marketplace WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint 7.2 High
- Show olderLoading…