CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- divvydrive information technologies inc. divvydriveStored XSS in DivvyDrive Information Technologies' DivvyDrive6.4 Medium
- mycomplianceoffice mco, mycomplianceoffice +1 moreStored Cross‑Site Scripting in MCO4.8 Medium
- eclipse open vsxIn Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files...4.1 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter7.2 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute6.4 Medium
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter6.1 Medium
- codename065 download managerDownload Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute6.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute6.4 Medium
- jetmonsters jetwidgets for elementorJetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting6.4 Medium
- stephen harris event organiserEvent Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode6.4 Medium
- dhruvin custom payment gateways for woocommerceCustom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter7.2 High
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through Cargo's map format6.9 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode6.4 Medium
- jgwhite33 wp google review sliderWP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter6.1 Medium
- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter6.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title6.4 Medium
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter7.2 High
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute6.4 Medium
- mozilla thunderbirdChat UI manipulation by injection6.5 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a...6.1 Medium
- google chromeInappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a...5.4 Medium
- google chromeIncorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker...4.2 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.1 Medium
- stonefly storage concentrator, storage concentrator virtual machine +1 moreCross-site Scripting in StoneFly Storage Concentrator5.1 Medium
- github enterprise serverStored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category6.3 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities8.5 High
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence6.4 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.4 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by a cross-site scripting vulnerability9.3 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by a cross-site scripting vulnerability9.3 Critical
- pfefferle webmentionWebmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties7.2 High
- seaweedfsSeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter2.3 Low
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)8.8 High
- rust-ammonia ammoniaammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip6.3 Medium
- eksagate electronic engineering and computer industry trade inc. sysguard 6001Stored XSS in Exagate's SYSGUARD 60016.1 Medium
- apache activemq, activemq web, apache software foundation activemq web console +2 moreApache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console6.1 Medium
- connekt media ajax load more - filtersAjax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field7.2 High
- intermark it webcontrol cmsMultiple vulnerabilities in Intermark IT's WebControl CMS5.1 Medium
- intermark it webcontrol cmsMultiple vulnerabilities in Intermark IT's WebControl CMS5.1 Medium
- konica minolta japan, inc. multiple mfps which implement ricoh web image monitor, ricoh company, ltd. multiple laser printers and mfps which implement ricoh web image monitor +1 moreMultiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor...5.1 Medium
- wpqode editorial rating – product review & rating systemEditorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field4.4 Medium
- wpmart team members – multi language supported team pluginTeam Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter4.4 Medium
- leandrocp mdexUnsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)5.1 Medium
- leandrocp mdex, mdex native +1 moreCross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute2.3 Low
- inovector mixpostMixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter5.1 Medium
- repute info systems arformsWordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…