CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravGrav - Stored CSS Injection via Markdown Image resize() Action4.8 Medium
- cap-go capgoCapgo - HTML Injection Leading to Open Redirection in Organization Settings4.8 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...7.1 High
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field7.2 High
- posimyththemes nexter blocks – gutenberg blocks, page builder & ai website builderNexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute6.4 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup6.4 Medium
- webbeyaz web design mediküm webStored XSS in Webbeyaz's Mediküm Web5.4 Medium
- webbeyaz web design mediküm webReflected XSS in Webbeyaz's Mediküm Web6.1 Medium
- limatek system inc. limrad nacStored XSS in Limatek's LimRAD NAC4.8 Medium
- mdempfle advanced iframeAdvanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute6.4 Medium
- seedprod website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance modeWebsite Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget…6.4 Medium
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter7.2 High
- idocoh sympl repeater for acf and elementorSympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values6.4 Medium
- chatra live chat + chatbot + cart saverChatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting4.4 Medium
- the champ social share, social login and social comments plugin – super socializerSocial Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter6.1 Medium
- better-authbetter-auth before 1.6.13 Stored XSS via javascript redirect_uri5.1 Medium
- lissy93 dashyDashy: XSS in workspace url parameter3.9 Low
- dataeaseDataEase: authenticated stored XSS in the dashboard text components5.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260706] - XSS in com_installer5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260704] - XSS in com_templates5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260705] - XSS in various modalreturn layouts5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260707] - XSS in the generic image output layout5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260703] - XSS in MFA method management5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260708] - XSS through language overrides5.9 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.1 for rhel 10 +5 more +7 moreJastow: jastow cross-site scripting attack due to unsanitized uri6.5 Medium
- digi international one ia, one sp, one sp ia +1 more +3 moreStored Cross-Site Scripting (XSS)4.8 Medium
- armiya information technologies ltd. co. access control system (gks)Reflected XSS in Armiya Technologies' Access Control System5.4 Medium
- armiya information technologies ltd. co. access control system (gks)Stored XSS in Armiya Technologies' Access Control System6.1 Medium
- timstrifler exclusive addons for elementorExclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- No product listedAn HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows...5.4 Medium
- No product listedAn authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of...5.4 Medium
- fossbillingFOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal4.8 Medium
- kiwitcms kiwiKiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)0.0 None
- showdownshowdown - Stored XSS via Unescaped Table Header ID Attribute Injection5.3 Medium
- coderCoder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component5.4 Medium
- showdownshowdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument5.3 Medium
- widgetpack reviews widgets for google, tripadvisor, yelp & recommendationsReviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute6.4 Medium
- owncloud drawio for owncloud, 10 +1 moreDrawIO for ownCloud 10 is vulnerable to Stored XSS8.2 High
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification6.1 Medium
- crater-invoice-inc cratercrater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting5.1 Medium
- mjperpinosa stumasymjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting5.1 Medium
- stephen-kruger blueboxstephen-kruger bluebox cross site scripting5.3 Medium
- code-projects assessment managementcode-projects Assessment Management remove-user.php cross site scripting5.3 Medium
- code-projects assessment managementcode-projects Assessment Management view-users.php cross site scripting4.8 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting5.3 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability7.2 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability7.1 High
- raera - ankara web design and digital advertising agency destekzXSS in Raera's Destekz6.1 Medium
- Show moreLoading…