CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- pluginops landing page builderWordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- astoundify jobifyWordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jma plugins woocommerce designer pro, woocommerce designer pro designer pro +1 moreWordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- realmag777 bearWordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting5.1 Medium
- code-projects online music sitecode-projects Online Music Site POST Request Feedback.php cross site scripting5.3 Medium
- codeastro complaint management systemCodeAstro Complaint Management System Report addreport cross site scripting5.1 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php add cross site scripting5.3 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting5.3 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php add cross site scripting5.3 Medium
- No product listedGotoHTTP reg.12x cross site scripting5.3 Medium
- lxml, fedora-python lxml html clean +1 morelxml: javascript: URL bypass in Cleaner via xlink:href8.2 High
- code-projects project management systemcode-projects Project Management System Mail Compose mail.php cross site scripting5.1 Medium
- yashpokharna2555 restaurent-management-systemyashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting5.3 Medium
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter4.4 Medium
- gpriday page builder by siteoriginPage Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter6.4 Medium
- surbma | infusionsoft shortcodeSurbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU6.4 Medium
- maxfoundry maxbuttons – create buttonsMaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter6.1 Medium
- vinod-dalvi ivory search – wordpress search pluginIvory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings4.4 Medium
- codepeople post map for google mapsCodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta6.4 Medium
dosagePyPIDosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers6.1 Medium- opf openprojectOpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration5.7 Medium
- opf openprojectOpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"6.4 Medium
- peregrinethemes hester coreWordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- nk ghost kitWordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- blockart magazine blocksWordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shahjahan jewel fluent bookingWordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- statcounterWordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle neve proWordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seedprod llc proWordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mervin praison featured imageWordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jellywp nanomagWordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- wedevs wemailWordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 foxWordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- surecartWordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- surecartWordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- xtemos woodmartWordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- perfmattersWordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cridiostudio listingproWordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- valvepress automaticWordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- adenion blog2socialWordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- cusrev customer reviews for woocommerceWordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- dfactory responsive lightboxWordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…