CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- elated-themes frappeFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'6.9 Medium
- elated-themes frappeFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload6.9 Medium
- elated-themes frappeFrappe: Stored XSS in Note6.9 Medium
- @clerk nuxtNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL5.1 Medium
- 2winfactor presto player, presto made, inc player +1 moreThe Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute6.4 Medium
- iova.mihai slicewpWordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- solidinvoiceSolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo8.1 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.3 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- unknown wp mail logWordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- broadcom spring web flow, spring web flow +1 moreSpring Web Flow JS RemotingHandler renders non-HTML Response as HTML4.8 Medium
- 100plugins open user map proOpen User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'4.7 Medium
- xibosignage xibo-cmsXibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet7.6 High
- quantumcloud simple link directorySimple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes5.1 Medium
- quantumcloud simple link directorySimple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option5.1 Medium
- yoast duplicate postYoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice5.1 Medium
- saas.group juicerJuicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API Response5.3 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface1.1 Low
- litestar-org litestarLitestar: HTML Injection Through CSRF Token8.1 High
- diagrams drawiodraw.io: XSS via crafted cell label when opening a .drawio file6.1 Medium
- splunk, splunk cloud platform, enterprise +2 moreStored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise7.1 High
- drupal mother may iMother May I - Critical - Unsupported - SA-CONTRIB-2026-0459.8 Critical
- drupal tagifyTagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-0435.4 Medium
- misp bsimvisMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels6.9 Medium
- roxy-wiRoxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)6.1 Medium
- kubev2v migration planner uiMigration-planner-ui-app: stored xss via javascript: url in agent credential link7.3 High
- jenkinsJenkins: Stored XSS vulnerability in node offline cause description5.4 Medium
- unknown wpzoom portfolio, wpzoom portfolio +1 moreWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability7.1 High
- smub athemes addons for elementoraThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting6.4 Medium
- websoudan mw wp formMW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter4.4 Medium
- brechtvds easy image collageEasy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters6.4 Medium
- agile logix store locator wordpressAgile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style3.5 Low
- unknown anti-spam by cleantalk. spam protectionSpam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass8.8 High
- wealcoder animation addons – elementor addons, gsap animations, elementor v4 atomic widgets & elementor templatesAnimation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters6.4 Medium
- frappe learning, lms +1 moreFrappe LMS: HTML injection in user-controlled metadata2.1 Low
- spring security, vmware spring security +1 moreUnencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting7.6 High
- open-emr openemrOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics7.7 High
- frankverbeke openclinic gaOpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler5.3 Medium
- brian-ruf oscal-guiOSCAL-GUI Reflected XSS via project parameter in oscal-forms.php5.1 Medium
- brian-ruf oscal-guiOSCAL-GUI Reflected XSS via project parameter in oscal.php5.1 Medium
- mozilla focus, focus for ios, klar +1 more +3 moreUXSS in Focus for iOS / Klar Webkit navigation7.5 High
- evoluted php directory listing scriptEvoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter5.1 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)4.8 Medium
- ellucian banner self-serviceEllucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API5.1 Medium
- ellucian banner self-serviceEllucian Banner Self-Service Reflected XSS via dateConverter5.1 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +2 moreAdobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)8.0 High
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +2 moreAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)4.8 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +2 moreAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability5.4 Medium
- Show moreLoading…