CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tibouille sudoku shortcodeSudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute6.4 Medium
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes6.4 Medium
- kingaddons king addons for elementor – 80+ elementor widgets, 4 000+ elementor templates, woocommerce, mega menu, popup builderKing Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter6.4 Medium
- wpvivid team backup for mainwp, wpvividplugins wpvivid backup for mainwp +1 moreWPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- thimpress wp hotel bookingWP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters6.1 Medium
- No product listedMyEMS Admin Backend svg.py on_post cross site scripting4.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting5.1 Medium
- siyuan-note siyuanSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)8.6 High
- cotontiCotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter5.1 Medium
- discourseDiscourse: Stored-XSS in 2FA delete confirmation modal7.3 High
- discourseDiscourse: Insufficient SVG sanitization logic5.4 Medium
- discourseDiscourse: Topic featured link susceptible to stored XSS7.4 High
- yeswikiYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)5.5 Medium
- webkul bagistoBagisto < 2.4.4 Stored XSS via CSTI in create.blade.php5.1 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities1.3 Low
- No product listedYzmCMS Header yzmphp.php get_url cross site scripting5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored web worker XSS via Pyodide7.3 High
- pluginsglpi tagTag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering7.3 High
- twiser informatics technology consulting, trade and education inc. okrs & goalsStored XSS in Twiser's OKRs & Goals5.4 Medium
- loopus wp cost estimation & payment forms builderWP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter7.2 High
- metagauss eventprime – events calendar, bookings and ticketsEventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter7.2 High
- oceanic software valeappXSS in Oceanicsoft's ValeApp9.3 Critical
- inrove software and internet services bieticaretXSS in Inrove Software's BiEticaret6.1 Medium
- kitae-park mang board wpMang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter6.1 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.04.8 Medium
- safistudio bookero.pl – system rezerwacji onlineBookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute6.4 Medium
- rnzo connect contact form 7 and mailchimpConnect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values7.2 High
- codename065 download managerDownload Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes6.4 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute6.4 Medium
- bouncingsprout block, suspend, report for buddypressBlock, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter6.4 Medium
- wpxpo post grid gutenberg blocks – postxPost Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute6.4 Medium
- microsoft dynamics 365 customer voiceDynamics 365 Customer Voice Spoofing Vulnerability9.3 Critical
- google chromeInappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote...6.1 Medium
- hp inc. poly ccx, poly edge e, poly trio c60 +2 morePoly Voice – Potential Unauthorized Modification of WebUI using XSS Attack5.9 Medium
- appium, appium appium\/base-driver +1 moreAppium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.3 High
- udecode platePlate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript8.7 High
- drupal ai seo/geo analyzer, j-vee ai seo\/geo analyzer +1 moreAI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0765.4 Medium
- ademarco ui patterns, drupal ui patterns (sdc in drupal ui) +1 moreUI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-0755.4 Medium
- drupal siteimprove analyticsSiteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0735.4 Medium
- lepture mistuneMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution6.1 Medium
- lepture mistuneMistune: XSS via unescaped class option in Admonition directive5.3 Medium
- lepture mistuneMistune: XSS via percent-encoded javascript URI bypass in safe_url()6.1 Medium
- honoHono: Server-Side XSS via JSX Escaping Bypass in cx() Utility6.1 Medium
- gchq cyberchefCyberChef: Prototype pollution in Series Chart operation5.0 Medium
- progress moveit transferStored XSS in MOVEit Transfer Ad Hoc module8.0 High
- Show moreLoading…