CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application serverIBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities6.1 Medium
- blackberry uem, unified endpoint manager +1 moreCross-Site Scripting (XSS) in Management Console of BlackBerry UEM8.6 High
- ibm sterling b2b integrator, sterling file gateway +1 moreCross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway5.5 Medium
- pivotickDOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick9.2 Critical
- pivotickPivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References6.3 Medium
- pivotickStored DOM-Based Cross-Site Scripting in Node Modal Headers6.9 Medium
- pivotickDOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons8.2 High
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 600+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute6.4 Medium
- strangerstudios paid memberships pro – content restriction, user registration, & paid subscriptionsPaid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- joomdle.com joomdle component for joomlaJoomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.16.1 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter7.2 High
- lrnz shortcodifyShortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute5.0 Medium
- elecom co.,ltd. wab-i1750-ps, wab-m1775-ps, wab-m2133 +2 more +4 moreELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting...5.1 Medium
- thewp digital solutions news theme v8Reflected XSS in theWP's News Theme V86.1 Medium
- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute6.4 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id7.1 High
- theeventscalendar event tickets and registrationEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move3.5 Low
- No product listedVersions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS)...5.3 Medium
- acymailing newsletter team anti spam and list cleaner – acycheckerWordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill kali formsWordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown backwpupWordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- nexcess givewpWordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- roxnor getgenieWordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- themefic ultimate addons for contact form 7WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability7.1 High
- kofi mokome message filter for contact form 7WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- cleantalk inc spam protection, antispam, firewall by cleantalkWordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability7.1 High
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- pivotickCross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links6.9 Medium
- lookylooStored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding9.2 Critical
- creativeitem ekushey project manager crmEkushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field5.1 Medium
- creativeitem ekushey project manager crmEkushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field5.1 Medium
- creativeitem ekushey project manager crmEkushey Project Manager CRM 5.0 Stored XSS via Client Name Field5.1 Medium
- roskus prospero flow crmStored XSS in Prospero Flow CRM email body allows administrator account takeover8.6 High
- apache wicketApache Wicket: crafted Link URL strings can break out of the JavaScript sequence6.1 Medium
- siyuan-note siyuanSiYuan before v3.7.2 Stored XSS to RCE via title-img IAL9.3 Critical
- siyuan-note siyuanSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass9.3 Critical
- acowebs checkout field editor for woocommerce – checkout managerWordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- 100plugins open user mapWordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sayontan photonic gallery & lightbox for flickr, smugmug & othersWordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shapedplugin llc location weatherWordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle orbit fox by themeisleWordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpdeveloper betterdocsWordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- miniorange wordpress social login and registerWordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tyche softwares abandoned cart lite for woocommerceWordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- themewant rt mega menu – mega menu builder for elementor & gutenbergWordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- acowebs dynamic pricing with discount rules for woocommerceWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…