CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- openwrt luciLuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting9.4 Critical
- openwrt luciluci-app-upnp Stored XSS via UPnP Port Mapping Description8.7 High
- akpali9 attendance-management-systemAkpali9 Attendance-Management-System absent.php cross site scripting5.1 Medium
- igweze wizgradeigweze wizgrade studentConductManager.php cross site scripting5.3 Medium
- robin wilson bbp style packbbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields6.4 Medium
- corvusinfo corvuspay woocommerce payment gateway, corvuspay woocommerce payment gateway +1 moreCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter7.2 High
- wclovers wcfm marketplace – multivendor marketplace for woocommerceWCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'6.4 Medium
- freshlabs fresh podcasterfresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes6.4 Medium
- trustindex widgets for google reviewsWidgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters4.4 Medium
- unknown white label cmsWhite Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings4.4 Medium
- wpvibes form vibes – save contact form 7 & elementor form entries to databaseForm Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field7.2 High
- leap13 premium addons for elementor – powerful elementor templates & widgetsPremium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter4.9 Medium
- themifyme themify builderThemify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field6.4 Medium
- starboardsuite starboard suite reservation calendarsStarboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- printfriendly print, pdf & email by printfriendlyPrint, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter4.4 Medium
- themifyme themify builderThemify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field6.4 Medium
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info7.2 High
- lustmored lockme calendars integrationLockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting4.4 Medium
- gallerycreator simply galleryMixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute6.4 Medium
- gristlabs grist-coreDOM-based XSS in Grist via unsanitized links, enabling privilege escalation8.5 High
- gristlabs grist-coreGrist: XSS through unsafe value interpolation in server-rendered pages7.7 High
- openreplayOpenReplay: Unauthenticated stored XSS leads to dashboard account takeover9.3 Critical
- github secure headerssecure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input4.7 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stored XSS in RabbitMQ management UI7.1 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering5.7 Medium
- logto-io logtoLogto: XSS via unescaped RelayState in SAML auto-submit form6.1 Medium
- grokability snipe-itSnipe-IT: CSS Injection via `header_color` Setting6.2 Medium
- grokability snipe-itSnipe-IT: Stored XSS via inline-served attachment6.2 Medium
- grokability snipe-itSnipe-IT: Stored XSS via Markdown custom field4.8 Medium
- hestiacp, hestiacp control panel +1 moreHestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface5.1 Medium
- zitadelZITADEL: Stored XSS via Default URI Redirect in Login V27.3 High
- webremium istanbul web design mezunum satiyorumXSS in Webremium's Mezunum Satiyorum6.4 Medium
- grafana oss, grafana +1 moreStored XSS in the table panel (TableNG)6.8 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was...3.5 Low
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible8.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent...7.3 High
- luceeLucee CFML Server Reflected XSS via URL Path Parsing6.2 Medium
- getgrav grav-plugin-apiGrav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer4.6 Medium
- getgrav gravGrav before 1.0.3 Stored XSS via SVG Upload API5.1 Medium
- logichunt logo slider wp – responsive logo carousel, logo gallery & logo showcaseLogo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter6.4 Medium
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget6.4 Medium
- papermerge dmsStored XSS in R-SOFT DMS5.1 Medium
- room 34 creative services, llc ics calendarICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter6.1 Medium
- prasunsen hostelHostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode6.4 Medium
- arraytics eventin – event calendar, event registration, tickets & booking (ai powered)Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter6.4 Medium
- looswebstudio highlighting code blockHighlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting4.4 Medium
- digiblogger buddyholis tablesearchBuddyHolis TableSearch <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wealcoder animation addons for elementor – gsap motion elementor addons & website templatesAnimation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget6.4 Medium
- pechenki telsender – сontact form 7, events, wpforms, ninja forms and woocommerce to telegram botTelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title7.2 High
- neeraj slit brevo – email, sms, web push, chat, and more.Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting6.1 Medium
- Show moreLoading…