CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- artbees jupiterx coreWordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- managewp workerWordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability7.1 High
- jgwhite33 wp google review sliderWordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability6.3 Medium
- it path solutions contact form to any apiWordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- bgermann cformsiiWordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- wc product table woocommerce product table liteWordPress WooCommerce Product Table Lite plugin <= 4.6.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeisle redirection for contact form 7WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- eli eli's wordcents adsense widget with analyticsWordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- arrayhq okay toolkitWordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- markbeljaars irobots.txt seoWordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cure53 dompurifyDOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM5.1 Medium
- cure53 dompurifyDOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName5.1 Medium
- angularAngular: Two-Way Property Binding Sanitization Bypass (XSS)5.3 Medium
- angularAngular: Template and Attribute Namespace Sanitization Bypass (XSS)5.3 Medium
- angular, red hat enterprise linux 8, fuse 7 +2 moreAngular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR8.6 High
- angularAngular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server8.6 High
- angularAngular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content5.3 Medium
- valhallaValhalla has reflected XSS via unsanitized JSONP callback parameter6.1 Medium
- angularAngular Client Hydration DOM Clobbering & Response-Cache Poisoning8.6 High
- liseperu elizaibotsWordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rewish wp emmetWordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- codepeople appointment booking calendarWordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS5.1 Medium
- codepeople booking calendar contact formWordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS5.1 Medium
- codepeople cp pollsWordPress CP Polls 1.0.8 Persistent Cross-Site Scripting5.1 Medium
- intelliants subrion cmsIntelliants Subrion CMS Blocks Endpoint cross site scripting4.8 Medium
- No product listedAn HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1...9.6 Critical
- No product listedA cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute...5.4 Medium
- No product listedRuoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.6.1 Medium
- No product listedPublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration...6.1 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting5.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie7.2 High
- codesupplyco canvasCanvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute6.4 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block6.4 Medium
- fooplugins photo gallery by foogallery : responsive image gallery, masonry gallery & carouselPhoto Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter6.4 Medium
- agile logix store locator wordpressAgile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name3.5 Low
- john-dagelmore gptranslate – multilingual ai translation for wordpress: automatically translate websitesGPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage7.2 High
- allegraAllegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability4.6 Medium
- fabricjs fabric.jsFabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization5.4 Medium
- apostrophecms @apostrophecms/seo@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag8.7 High
- apostrophecms sanitize-htmlsanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes5.4 Medium
- apostrophecms apostropheApostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip5.3 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting5.1 Medium
- mispMISP UiBeta event index reflected XSS in advanced filter popup5.3 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Dashboard add_tod cross site scripting5.1 Medium
- mispMISP Overmind theme stored XSS via unvalidated homepage setting5.1 Medium
- parse-community parse-serverParse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist2.1 Low
grumpydictator/firefly-iiiPackagistFirefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)5.1 Medium- Show moreLoading…