CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- gfi software archiverGFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx5.1 Medium
- cure53 dompurifyDOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage5.1 Medium
- wp chill modula image galleryWordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- siyuan-note siyuanSiYuan before v3.7.2 Cross-Site Scripting to RCE9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Stored XSS to RCE via Attribute View9.4 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification,...4.3 Medium
- billy bryant tabsWordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- nilo velez macheteWordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- charlie etienne custom links in elementor image carouselWordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wbolt.com smart seo toolWordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bannersky bsk pdf managerWordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- liquid design ltd. speech balloon, lqd liquid speech balloon +1 moreWordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pixelacehq manual - documentation, knowledge base & education wordpress themeWordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gt3 themes photo galleryWordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- scott paterson accept donations with paypal & stripeWordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepeople appointment hour bookingWordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pixelacehq manual - documentation, knowledge base & education wordpress themeWordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dokan pro, wedevs dokan pro +1 moreWordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- hashthemes demo importerWordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- la-studio element kit for elementorWordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codexthemes thegemWordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess virtue/ascend/pinnacle toolkitWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shahjahan jewel fluent supportWordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpvibes form vibes – database manager for formsWordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- booklyWordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- hassantafreshi easy form builderWordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability7.1 High
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pi web solution product enquiry for woocommerceWordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability7.1 High
- affiliatewpWordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods grand photographyWordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- code cabin inc wp google maps proWordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability7.1 High
- breakdanceWordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- storeapps smart managerWordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- webcodingplace real estate manager proWordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bqworks slider proWordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- boldgrid sprout clientsWordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- download monitor - wpforms lockWordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- thimpress. coachingWordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- membership software wishlist member xWordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wisetr inc. funnel kit funnel builder proWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wisetr inc. funnel kit funnel builder proWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepress it solutions llc visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nerdpress hubbub liteWordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- supsystic photo gallery by supsysticWordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- Show moreLoading…