CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- crawl4aiCrawl4AI - Server-Side Request Forgery via Webhook URLs9.2 Critical
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Parameter8.8 High
- adobe acrobat, acrobat pdf extension (chrome) +1 moreAdobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class...7.4 High
- oracle human resourcesVulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person...7.5 High
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...9.6 Critical
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...9.6 Critical
- gohugo hugoHugo: XSS via text/html content files5.1 Medium
- n8nn8n: Same-Origin XSS in Respond to Webhook Node7.0 High
- powerschool employee access centerReflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.105.7 Medium
- openclawOpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML2.1 Low
- dell powerstorePowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A...5.4 Medium
- astroAstro: XSS via Unescaped Attribute Names in Spread Props4.2 Medium
bleachPyPIBleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes6.1 Medium- astroAstro: Reflected XSS via unescaped slot name7.1 High
- @clerk nuxtNuxt - Cross-Site Scripting via navigateTo open Option5.3 Medium
- @clerk nuxtNuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp5.3 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pods framework podsWordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpfactory min max step quantity limits manager for woocommerceWordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- deepakkite secure client portal and private file sharing plugin – user private filesFile Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter6.4 Medium
- slimSlim has Reflected XSS in the HtmlErrorRenderer6.1 Medium
- @clerk nuxtNuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo5.3 Medium
- wp-buy seo redirectionWordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability7.1 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- glen don mongaya drag and drop multiple file upload – contact form 7WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- funnelkit funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- groundhogg hollerboxWordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ahmad wp job portalWordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- trumani stop spammersWordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- takashi kitajima mw wp formWordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- king addons for elementor, kingaddons.com king addons for elementor +1 moreWordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- saad iqbal post smtpWordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- bhavin thummar product filter widget for elementorWordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill modula image galleryWordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eventprimeWordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mamunur rashid classified listingWordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- wasiliy strecker contest galleryWordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability7.2 High
- archetyped favicon rotatorWordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability7.1 High
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- elliot sowersby / relywp coupon affiliatesWordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- rainafarai notification for telegramWordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- amit mittal shipment tracker for woocommerceWordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeisle social slider feedWordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…