CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- crocoblock jetreviewsWordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- haktan suren handl utm grabberWordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- andy fragen wp debuggingWordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- etruel wpematico rss feed fetcherWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability7.1 High
- webraketen internal links managerWordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- radiustheme classified listingWordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- contempo themes real estate 7WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- shortpixel adaptive imagesWordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tranmautritam thefoxWordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themesuite automotive car dealership businessWordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themesuite automotive listingsWordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- imithemes nativechurchWordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes lmsWordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes kids life | children school wordpressWordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- design themes kids zone - children wordpress themeWordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes fitness zone wordpress themeWordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes spalab | beauty salon wordpress themeWordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- designthemes trendy travelWordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods artale | wedding photography wordpressWordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- nikhilgadhiya product video gallery for woocommerceProduct Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter4.4 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute6.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form6.4 Medium
- figureone insert pagesInsert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)6.4 Medium
- craftcms cmsCraft CMS: DOM XSS via GitHub issue title in CraftSupport widget7.4 High
- craftcms cmsCraft CMS: Stored XSS via Structure entry title in table view5.9 Medium
- torchbox wagtailWagtail: Reflected XSS in dynamic image URL generator view7.3 High
- silverstripe silverstripe-frameworkSilverstripe Framework: Possible XSS attack through media embed5.4 Medium
- xdan joditJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier7.2 High
- mediawiki, the wikimedia foundation mediawiki - charts extension +1 moreStored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title6.9 Medium
spatie/schema-orgPackagistSchema.org has cross-site scripting (XSS) via script break-out in toScript() output1.3 Low- butlerx wettywetty vulnerable to DOM XSS via file-download filename8.6 High
easycorp/easyadmin-bundlePackagistEasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components5.3 Medium- geonetwork core-geonetworkGeoNetwork: Reflected XSS through client-side template injection7.1 High
- averta shortcodes and extra features for phlox themeWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- colorbox project colorboxColorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0695.4 Medium
- drupal canvasDrupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-0666.1 Medium
- drupal canvasDrupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-0656.1 Medium
- shortpixel enable media replaceWordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- guardian language-systemGuardian Language-System XSS via id Parameter in media.php4.8 Medium
- guardian language-systemGuardian Language-System XSS via id Parameter in text_file.php4.8 Medium
- guardian language-systemGuardian Language-System XSS via name Parameter in designer.php4.8 Medium
- mediawiki, wikimedia foundation centralauth +1 morePretty-printed API output combined with centralauthtoken allows XSS with certain gadgets0.0 None
- wikimedia foundation timeline, mediawiki +1 moreStored XSS through javascript URLs in SVGs generated by EasyTimeline0.0 None
- mediawiki, wikimedia foundation syntaxhighlight geshi +1 moreSyntaxHighlight stored XSS via unsanitized 'linelinks' attribute5.3 Medium
- mediawikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=html5.3 Medium
- mediawikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input0.0 None
- mediawikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selected0.0 None
- wikimedia foundation checkuser, mediawiki +1 moreStored XSS through a system message when blocking a temporary account that's related to other temporary accounts0.0 None
- divvydrive information technologies inc. divvydriveStored XSS in DivvyDrive Information Technologies' DivvyDrive5.4 Medium
- mediawikiStored XSS through a system message in the codex version of Special:Block0.0 None
- Show moreLoading…