CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- shaarliShaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links5.8 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Improper validation - SA-CORE-2026-0095.4 Medium
- filamentphp filamentFilament: Disabled RichEditor field state can be used for XSS7.6 High
- gitea open source git serverGitea 3D file viewer allows stored XSS through glTF extensionsRequired8.7 High
- pragdave earmarkStored XSS via unescaped HTML attribute values in earmark4.8 Medium
- makeplane planePlane 1.3.1 - Stored XSS in intake issue description_html6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI7.6 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS in Mermaid Markdown Preview8.7 High
- nocodbNocoDB: Stored Cross-Site Scripting via Secure Attachment5.1 Medium
- royal elementor addons proWordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability7.1 High
- seventhqueen sweetdate coreWordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods avanteWordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- simplcommerceStored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface6.2 Medium
- themify foloWordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro popup boxWordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpfunnels proWordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- presslayouts kapeeWordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- collect.chat inc. collectchatWordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpzoom addons for elementorWordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jobster marketplace wpjobsterWordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeum skillateWordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- vamtam auto repairWordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sonaar music sonaarWordPress Sonaar theme <= 4.27.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- mythemes my flatonicaWordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- teldat regesta smart hd-plc - tldph16d2CROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDAT4.8 Medium
- maciej bis permalink manager litePermalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycredmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute6.4 Medium
- taskbuilderTaskbuilder < 5.0.8 - Reflected XSS via Shortcode7.1 High
- unknown wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail < 2.1.3 - Reflected Cross-Site Scripting7.1 High
- google chromeInappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a...4.7 Medium
- google chromeInappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote...6.1 Medium
- earendil-works piPi: Potential XSS in HTML session exports via Markdown URL sanitization bypass2.5 Low
- @clerk nuxtNuxt - Cross-Site Scripting via NoScript Component Slot Content2.3 Low
- n8nn8n: Stored XSS in Chat Trigger Node7.0 High
- n8nn8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints6.8 Medium
- umputun remark42Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing8.2 High
- kriesi enfoldWordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sneeit magoneWordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods grand car rentalWordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- jkdevstudio qreatixWordPress Qreatix theme <= 1.9.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- crawl4aiCrawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints9.2 Critical
- crawl4aiCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key9.3 Critical
- crawl4aiCrawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint9.2 Critical
- crawl4aiCrawl4AI - Stored Cross-Site Scripting in Monitor Dashboard5.3 Medium
- crawl4aiCrawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server6.9 Medium
- Show moreLoading…