CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- media manager tastyigniterStored Cross-Site Scripting (XSS) in TastyIgniter Media Manager6.3 Medium
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.15.1 Medium
- humhub calendarCalendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter6.8 Medium
- unknown smart managerSmart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title4.8 Medium
- shaonsina sina extension for elementorSina Extension for Elementor < 3.10.2 - Reflected XSS6.1 Medium
- themeisle mpgMultiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode7.1 High
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information6.1 Medium
- dan rossiter document galleryDocument Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery6.1 Medium
- monetizemore advanced adsAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter6.1 Medium
- xmlrpc-cXMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting...8.2 High
- No product listedCross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8...6.1 Medium
- codexu notegenNoteGen chat preview XSS via unsanitized AI/skill HTML rendering8.1 High
- yoast seo – advanced seo with real-time guidance and built-in aiYoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)6.4 Medium
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
- openidentityplatform openamOpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page6.1 Medium
- milkdownMilkdown < 7.21.3 DOM XSS via innerHTML Assignment5.1 Medium
- milkdownMilkdown < 7.21.3 Stored XSS via javascript: URL in link href5.1 Medium
- basecamp trixTrix: Stored XSS via HTMLParser attribute injection on paste4.6 Medium
Magick.NET-Q16-AnyCPUNuGet,Magick.NET-Q16-arm64NuGet,Magick.NET-Q16-HDRI-AnyCPUNuGet +14 more +16 moreImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-257975.7 Medium- ekol informatics website templateReflected XSS Polen Media's Website Template6.1 Medium
- loytec lweb-802Loytec LWEB802: Reflected Cross-Site Scripting in LWEB8028.7 High
- loytec l-dali, l-gate, l-inx +5 more +7 moreLoytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server8.7 High
- google cloud lookerCross-Site Scripting (XSS) in Looker allows Admin Account Takeover8.7 High
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter7.2 High
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter6.1 Medium
- richplugins rich showcase for google reviewsRich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute6.4 Medium
- brainstormforce suredash – community, courses & member dashboardSureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- themeisle visualizer – tables & charts manager with built-in ai generatorVisualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter6.4 Medium
- thimpress wp hotel bookingWP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute6.4 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- 100plugins open user map – interactive leaflet mapsOpen User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 600+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute6.4 Medium
- techjewel fluent support – helpdesk & customer support ticket systemFluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute6.4 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 600+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute6.4 Medium
- oyatek mapsvg – vector maps, image maps, google mapsMapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- firelightwp firelight lightboxFirelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute6.4 Medium
- wpxpo post grid gutenberg blocks – postxPost Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute6.4 Medium
- progress moveit transferStored XSS vulnerability in MOVEit Transfer7.1 High
- @tanstack react-routerReact Router: Open redirect can lead to XSS6.9 Medium
- @tanstack react-routerReact Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)6.9 Medium
- phoca.cz phoca guestbook extension for joomlaJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.05.1 Medium
- phoca.cz phoca maps extension for joomlaJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.45.1 Medium
- fathomFathom Lite 1.3.1 Stored XSS via /collect Endpoint5.1 Medium
- gfi software archiverGFI Archiver < 15.14 Stored XSS via MailInsights.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx5.1 Medium
- gfi software archiverGFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx5.1 Medium
- Show moreLoading…