CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- edge22 generateblocksGenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute6.4 Medium
- themegrill zakraZakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API6.4 Medium
- advancedcoding comments – wpdiscuzComments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field7.2 High
- rometheme rtmkitRTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter6.4 Medium
- parorrey json api userJSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter6.4 Medium
- creativemindssolutions cm business directory – optimise and showcase local businessCM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields6.4 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter7.2 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field6.4 Medium
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attribut…6.4 Medium
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute6.4 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration4.8 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module4.8 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration4.8 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration4.8 Medium
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration4.8 Medium
- forgejoForgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering2.1 Low
- infiniflow ragflowRAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name5.1 Medium
- netdataNetdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint5.1 Medium
- drakkan sftpgoSFTPGo: Stored XSS via inline parameter on public shares and user file download3.7 Low
- asymmetric-effort specifyjs@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString5.3 Medium
- professionalwiki mapsmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function8.6 High
- tp-link systems inc. archer c5 v6.8Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management Interface7.0 High
- tr7 cyber defense inc. waf-aspStored XSS in TR7's WAF-ASP5.4 Medium
- tr7 cyber defense inc. waf-aspDOM-Based XSS in TR7's WAF-ASP4.6 Medium
- u5cmsPOST-based reflected XSS via the thanks parameter in form components6.4 Medium
- revolution slider slider revolutionWordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability7.1 High
- surbma | yoast seo breadcrumb shortcodeWordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codemacher structured contentWordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- andrew fiebert simple urlsWordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- misbah wp mosaic gallery – advanced galleryWordPress Mosaic Gallery – Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- livemesh addons for wpbakery page builderWordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpxpo wowaddonsWordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- tranmautritam thefoxWordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quantumcloud simple link directoryWordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability7.1 High
- arraytics timeticsWordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability7.1 High
- optimoleWordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- melograno venture studio wpdatatablesWordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- perfmattersWordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- codepeople google maps cpWordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- ase admin and site enhancements (ase) proWordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability9.6 Critical
- chill media labs s.r.l. modula - proWordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- greg winiarski wpadvertsWordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- quantumcloud chatbotWordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro survey makerWordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- reviewxWordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- sysbasics customize my account for woocommerceWordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- search atlas seo, search atlas group atlas seo +1 moreWordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- moreconvert mc woocommerce wishlistWordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…