CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- gamerz wp-pollsWordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- mahethekiller header footer script adderHeader Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta6.4 Medium
- regularlabs.com keyboard shortcuts extension for joomlaJoomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension6.1 Medium
- berocket grid/list view for woocommerceGrid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute6.4 Medium
- equalizedigital equalize digital accessibility checker – wcag, ada, eaa and section 508 complianceEqualize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter6.4 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field4.4 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4 Medium
- niklaslindemann bulk page generator – lpageryBulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- mythemeshop wp shortcode by mythemeshopWP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- webpushr web push notifications – webpushrWeb Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter6.4 Medium
- repute info systems arformsARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values7.2 High
- unknown post status notifier litePost Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter4.8 Medium
- aresit wp compressWP Compress < 7.10.04 - Reflected XSS via test_zone6.1 Medium
- formcraftFormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters7.2 High
- fantasticplugins sumo reward points for woocommerceSUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter7.2 High
- jupyterlabJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)8.6 High
- jupyterlabjupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab7.5 High
- regularlabs.com articles anywhere pro extension for joomla, modals extension for joomla, modules anywhere pro extension for joomla +2 more +4 moreJoomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions5.4 Medium
- regularlabs.com advanced module manager extension for joomla, conditional content extension for joomla, content templater pro extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager4.8 Medium
- drupal search api autocompleteSearch API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0826.1 Medium
- drupal media foldersMedia Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-0806.1 Medium
- froiden tabletrackFroiden TableTrack 1.3.10 Stored XSS via Order Notes Field5.3 Medium
- unblu inc. sparkUnblu Spark Open Redirect leading to DOM-Based XSS9.3 Critical
- n8nn8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe8.2 High
- n8nn8n before 1.123.64 Stored DOM XSS via cachedResultUrl8.4 High
- brainstorm force ultimate addons for elementorUltimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes6.4 Medium
- joomshopping.com joomshopping extension for joomlaJoomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.35.3 Medium
- unknown product addons and product options with custom fieldsProduct Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload8.8 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSIS.php cross site scripting5.3 Medium
- rails rails-html-sanitizerrails-html-sanitizer: Possible XSS vulnerability with certain configurations5.1 Medium
- flavorjones loofahLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons2.3 Low
- flavorjones loofahLoofah: SVG `href` attribute bypasses local-reference restriction4.7 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System class.php cross site scripting5.3 Medium
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web...8.0 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web...8.0 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.8 High
- fogprojectFOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab4.6 Medium
- fogprojectFOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint7.3 High
- fogprojectFOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page7.3 High
- svg svgoSVGO: removeScripts plugin leaves some executable scripts intact8.2 High
- dhis2 dhis2-coreDHIS2 Reflected XSS in OpenAPI HTML scope parameter7.3 High
- solarwinds serv-uSolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability6.2 Medium
- home-assistant home assistant coreHome Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI2.1 Low
- Show moreLoading…