CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- saturday drive ninja formsNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index9.3 Critical
- rust-ammonia ammoniaammonia allows stored XSS through unsanitized SVG animate and set attributes5.4 Medium
- getgrav gravGrav Stored Cross-Site Scripting via Shortcode Attribute Handlers5.1 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget6.4 Medium
- unknown free theme builder for elementorCRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form8.8 High
- smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & moreWPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content4.9 Medium
- hclsoftware devops planHCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability2.3 Low
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings6.4 Medium
- No product listedCross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain...6.1 Medium
- No product listedCross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker...8.1 High
- withastro astroAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)5.1 Medium
- withastro astroAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands2.1 Low
- brainstormforce spectra legacy – gutenberg blocksSpectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block6.4 Medium
- withastro astroAstro: Reflected XSS via unescaped View Transition animation properties5.3 Medium
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.15.1 Medium
- themexpert.com jmedia extension for joomlaJoomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.09.4 Critical
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.18.6 High
- bestpractical rt, request tracker +1 moreRT: Stored Cross-Site Scripting via insufficient template escaping5.4 Medium
- chamilo chamilo-lmsChamilo stored XSS via user registration leads to admin account takeover9.3 Critical
- heyformHeyForm vulnerable to stored XSS via form field titles9.0 Critical
- heyformHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload6.4 Medium
- bifra engineering consulting ltd. q-smart next pollStored XSS in Bifra Engineering's Q-smart NexT Poll5.4 Medium
- mwtcmi frogmanFrogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)4.8 Medium
- maalfer pentestifyStored XSS in Pentestify via unsanitized finding images and report client logo6.9 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification6.1 Medium
- stevejburge tag groups is the advanced way to display your taxonomy termsTag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter7.1 High
- thimpress learnpressLearnPress < 4.4.1 - Reflected XSS via c_search7.1 High
- unknown slimstat analyticsSlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header7.5 High
- unitecms unlimited elements for elementorUnlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget8.8 High
- No product listedCross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote...6.1 Medium
- No product listedMettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in...6.1 Medium
- itsourcecode courier management systemitsourcecode Courier Management System index.php cross site scripting5.3 Medium
- code-projects online examination systemcode-projects Online Examination System account.php cross site scripting5.3 Medium
- pluck cmsPluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting4.8 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forCYS.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System CYS.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forexam.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting5.1 Medium
- lollms, parisneo parisneo/lollms +1 moreStored XSS in Direct Messages via Prompt Sharing in parisneo/lollms8.7 High
- flow paymentFlow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter5.1 Medium
- ibm engineering ai hubMultiple Vulnerabilities in IBM Engineering AI hub.9.3 Critical
- astrbotdevs astrbotAstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting5.1 Medium
- sangoma switchvox smb editionAuthenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal7.0 High
- sangoma switchvox smb editionUnauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal8.6 High
- chronoengine.com chronoforms extension for joomlaJoomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.528.7 High
- basix nex-formsNEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission6.1 Medium
- thimpress wp hotel bookingWP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter6.1 Medium
- themeatelier chathelp – click to chat button, woocommerce chat to order & floating chat formChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes6.4 Medium
- saturdaydrive ninja forms - excel exportNinja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter6.4 Medium
- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value7.2 High
- Show moreLoading…