CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- evertec woocommerce placetopay gateway, woocommerce placetopay gateway belice, woocommerce placetopay gateway colombia +3 more +5 moreWooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'6.1 Medium
- inc2734 smart custom fieldsSmart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title6.4 Medium
- No product listedA cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and...6.1 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft windows admin centerWindows Admin Center Spoofing Vulnerability6.1 Medium
- emlogEmlog Reflected Cross-Site Scripting8.5 High
- ultimate fosters perfect support ticketing & document management systemPerfect Support Ticketing System 1.7 Stored XSS via Ticket Notes Field5.1 Medium
- phppoet sysbasics customize my account for woocommerce – live my account customizerSysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter4.4 Medium
- tomdever wpforo forumwpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field6.4 Medium
- tickera – sell tickets & manage eventsTickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute6.4 Medium
- breakdanceBreakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details7.2 High
- wpdelicious wp delicious – recipe plugin for food bloggers (formerly delicious recipes)WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute6.4 Medium
- unknown funnelkitFunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form7.1 High
- unknown header footer builder for elementorHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import6.1 Medium
- unknown betterdocsBetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection6.1 Medium
- yo35 rpb chessboardRPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- rextheme product feed manager for woocommerce – sell on 200+ online marketplacesProduct Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter6.1 Medium
- shapedplugin easy accordion – ai-powered faq & accordion blocks, product faqEasy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute6.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting6.4 Medium
- mxchat – ai chatbot & content generation for wordpressMxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting4.4 Medium
- github view componentview_component: around_render HTML-Safety Bypass8.7 High
- drupal coreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0125.4 Medium
- drupal coreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0114.7 Medium
- dataeaseDataEase: Authenticated Stored XSS in DataEase Template Static Resources6.3 Medium
mantisbt/mantisbtPackagistMantisBT: Stored XSS in print_all_bug_page_word.php8.6 Highmantisbt/mantisbtPackagistMantisBT: Reflected XSS in admin/install.php via unescaped printf9.2 Criticalmantisbt/mantisbtPackagistMantisBT: Reflected XSS in admin/install.php9.2 Critical- openwrtOpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI9.6 Critical
- iidk-the-actual consoleRustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover9.0 Critical
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.4.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.4.6 Medium
- hcl notesReflected XSS in HCL Notes5.5 Medium
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)6.1 Medium
- getgrav gravGrav before 2.0.1 XSS via Twig String Concatenation5.1 Medium
- weeblr.com 4analytics extension for joomlaJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.28.7 High
- weeblr.com 4analytics extension for joomlaJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.28.6 High
- No product listedCross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute...6.1 Medium
- jadx project jadxjadx: HTML Injection in Summary panel3.6 Low
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)8.5 High
- easycorp easyadminbundleEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField7.6 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)4.8 Medium
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.1 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7 High
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- Show moreLoading…