CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- thrive themes coupon architectWordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- nexcess givewpWordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- brainstorm force ultimate addons for elementorWordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seo squirrly plugin by squirrly seoWordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability7.1 High
- pixelite events managerWordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- xplodedthemes wpide – file manager & code editorWordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- berocket advanced ajax product filtersWordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro survey makerWordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- property hive houzez property feedWordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability7.1 High
- jordy meow ai engineWordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- rajat varlani super socializerWordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- scott paterson easy paypal buy now buttonWordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- affiliatewpWordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpdatatablesWordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- jp-secure siteguard wp pluginWordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- shahjahan jewel ninja tablesWordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpdeveloper embedpressWordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- damian góra fibosearchWordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- codesupplyco powerkitWordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- code atlantic llc popup maker, popup maker maker +1 moreWordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpmu dev forminatorWordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- imagely nextgen galleryWordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution6.4 Medium
- logo software industry and trade inc. e-logo purchasing portalStored XSS in Logo Software's e-Logo Purchasing Portal5.4 Medium
- wpwax formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & moreFormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressLatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- wpxpo post grid gutenberg blocks – postxPostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block6.4 Medium
- posimyth nexter blocksNexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload6.1 Medium
- unknown child pages cardChild Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes5.4 Medium
- unknown slick sliderSlick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode5.4 Medium
- unknown eonsr aeo agentEONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation6.1 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- metaslider slider, gallery, and carousel by metaslider – image slider, video sliderSlider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting6.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field7.2 High
- wpmanageninja fluentsmtp – wp smtp plugin with amazon ses, sendgrid, mailgun, postmark, cloudflare, tosend, gmail and any smtpFluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs7.2 High
- No product listedIn Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.8.8 High
- ttttonyhe oblogttttonyhe OBlog tags.php cross site scripting5.3 Medium
- drupal entity browser, entity browser project browser +1 moreEntity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-0944.8 Medium
- jenkins project summary display pluginJenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript...5.4 Medium
- jenkins project qualys container scanning connector pluginJenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user...5.4 Medium
- cisco enterprise nfv infrastructure software, unified computing system (standalone), unified computing system e-series software (ucse) +2 moreCisco Integrated Management Controller Cross-Site Scripting Vulnerability4.8 Medium
- progress marklogic serverCross-site scripting in Progress MarkLogic Server Query Console9.3 Critical
- projectsendReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters5.1 Medium
- tryghost ghostGhost: Cross-Site Scripting in Feature Image Captions4.3 Medium
- bensibley independent analytics – wordpress analytics pluginIndependent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- Show moreLoading…