CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedA stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper...6.1 Medium
- No product listedosTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header...6.1 Medium
- openwrt luciluci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name5.1 Medium
- timstrifler exclusive addons for elementorExclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'6.4 Medium
- syed balkhi charitableCharitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text4.8 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content5.4 Medium
- unknown narrative publisherNarrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta4.6 Medium
- unknown rt mega menuRT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS5.4 Medium
- bdthemes element pack addons for elementorElement Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes6.8 Medium
- crocoblock jetengineJetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode5.4 Medium
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget6.1 Medium
- @better-auth sso@better-auth/sso before 1.6.21 Account Takeover via SSO8.6 High
- openwrt luciluci-app-https-dns-proxy Stored XSS via resolver_url6.8 Medium
- nik00726 responsive thumbnail sliderResponsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter6.1 Medium
- codesupplyco powerkit – supercharge your wordpress sitePowerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'6.1 Medium
- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode6.4 Medium
- codesupplyco powerkit – supercharge your wordpress sitePowerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 700+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute6.4 Medium
- pluginops mailchimp subscribe form, optin builder, popup builder, form builderMailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values7.2 High
- codename065 download managerDownload Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute6.4 Medium
- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode6.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute6.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content6.4 Medium
- codesupplyco powerkit – supercharge your wordpress sitePowerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute6.4 Medium
- mihail-barinov advanced woo labels – product labels & badges for woocommerceAdvanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter6.4 Medium
- edge22 generateblocksGenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes6.4 Medium
- merv barrett easy property listingsEasy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method6.4 Medium
- codename065 download managerWordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title5.4 Medium
- acowebs dynamic pricing with discount rules for woocommerceDynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax7.1 High
- tomdever wpforo forumwpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field5.4 Medium
- unknown admin columns for acf fieldsAdmin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column5.4 Medium
- unknown codeless page builderCodeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute5.4 Medium
- unknown bit formBit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label4.8 Medium
- sendpulse email marketing newsletterSendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta6.4 Medium
- brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quizSureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute6.4 Medium
- xdan joditJodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS5.4 Medium
- aws ops wheelStored XSS in Participant URL Field leads to Account Takeover via Session Token Theft6.2 Medium
- johnson controls fm systems employee, johnsoncontrols fms employee +1 moreFMS Employee vulnerable to XSS4.8 Medium
- roskus prospero flow crmStored Cross-site Scripting in Prospero Flow CRM lead name field5.3 Medium
- php jabbers poll scriptReflected XSS in PHP Poll Script5.1 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field8.8 High
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)3.5 Low
- opajaap wp photo album plusWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment6.1 Medium
- brainstorm force ultimate addons for wpbakery page builderUltimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode6.1 Medium
- ice00 newstatpressNewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget6.1 Medium
- unknown lightbox with photoswipeLightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute6.8 Medium
- comfy-org comfyuiComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization8.2 High
- comfy-org comfyuiComfyUI: Stored XSS via SVG file upload on the /view endpoint8.2 High
- No product listedA reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150...6.1 Medium
- Show moreLoading…