CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- jegstudio gutenverse formWordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- aerin quick interest sliderWordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- chrisvrichardson mappress maps for wordpressWordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- kerry bne testimonialsWordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ghozylab image carouselWordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tim strifler exclusive addons elementorWordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jupyter jupyter/jupyterCross-site Scripting (XSS) in jupyter/nbconvert5.4 Medium
- rapid7 insightconnect markdown pluginServer-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin4.8 Medium
- revive adserver, revive-adserver revive adserver +1 moreA missing sanitisation vulnerability exists with user input in the stats-video.php script. The...4.7 Medium
- revive adserver, revive-adserver revive adserver +1 moreA stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners...4.4 Medium
- revive adserver, revive-adserver revive adserver +1 moreA missing sanitisation vulnerability of user input in the zone-include.php script exists in...6.1 Medium
- kohaA stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha...5.4 Medium
- kohaA stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library...5.4 Medium
- kohaCross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of...6.1 Medium
- redhat pen drive, red hat pen drive powered by red hat lightspeed +1 morePen-drive: pen-drive: stored xss via unescaped cluster data in html report6.9 Medium
- emilstenstrom justhtmljusthtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass7.3 High
- danny-avila librechatLibreChat: Stored XSS via unescaped image alt text in markdown artifact preview5.4 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.263.4 Low
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.266.1 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- tablepressWordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- algolplus advanced order export for woocommerceWordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- averta master sliderWordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- h5pWordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- melapress wp activity logWordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.0 High
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsGutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute6.4 Medium
- quest netvault backupQuest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability8.8 High
- cactiCacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context5.3 Medium
- cactiCacti has a Reflected XSS Vulnerability via html_auth_footer5.3 Medium
- siyuan-note siyuanSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)9.0 Critical
- siyuan-note siyuanSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client8.7 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS in Bazaar marketplace via package README event handlers7.1 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()9.9 Critical
- rocket.chatRocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images4.4 Medium
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-0546.1 Medium
- anuaralfetahe advanced content feedback, drupal advanced content feedback (aka admin feedback) +1 moreAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0516.1 Medium
- jellyfinJellyfin: Potential XSS in user management5.7 Medium
- tryghost ghost@tryghost/activitypub: XSS in Ghost's ActivityPub client7.5 High
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering4.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering4.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config4.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering4.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering4.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering4.6 Medium
- Show moreLoading…