CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- unknown autopayAutopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor8.8 High
- unknown advanced excerptAdvanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting4.8 Medium
- unknown saitama addon packSaitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta5.4 Medium
- crocoblock jetengineJetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)6.1 Medium
- code-projects task management systemcode-projects Task Management System CommentSave.php cross site scripting5.3 Medium
- lws optimize, unknown lws optimize +1 moreLWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring6.1 Medium
- unknown ymc filterYMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload6.8 Medium
- unknown ymc filterYMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema5.4 Medium
- unknown link libraryLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel6.1 Medium
- shapedplugin easy accordion – ai-powered faq & accordion blocks, product faqEasy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute6.4 Medium
- treeverse lakefs, lakefs-enterprise +1 morelakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML8.7 High
- domoticzDomoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering2.0 Low
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, org.hl7.fhir.core +2 moreHAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles5.0 Medium
- sourcecodester photo share websiteSourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting5.1 Medium
- wordpressWordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escala…8.9 High
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name6.3 Medium
- dartiss code-embedCode Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed6.5 Medium
- sourcecodester photo share websiteSourceCodester Photo Share Website index.php home cross site scripting5.1 Medium
- phpgurukul company visitor management systemPHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting4.8 Medium
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.08.7 High
- dartiss shareopenlyShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output5.3 Medium
- tobit laboratories ag teamdavidTeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter5.3 Medium
- jordy meow meow galleryMeow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text5.4 Medium
- kerry kline bne testimonialsBNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode5.4 Medium
- unknown commentswpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion6.1 Medium
- unknown subscribe2Subscribe2 < 10.46 - Reflected XSS via email Parameter6.1 Medium
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes6.4 Medium
- microsoft sharepoint onlineMicrosoft Office SharePoint Spoofing Vulnerability9.6 Critical
- elated-themes frappeFrappe: Stored XSS in Column Headers via Data Import5.1 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name5.1 Medium
pdfjs-distnpm,@rootio/pdfjs-distRoot +1 morePDF.js: Arbitrary JavaScript execution upon opening a malicious PDF8.6 High- open-reception appointment-booking-softwareOpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer8.1 High
- jhy jsoupjsoup: Cleaner may expose markup with custom raw-text elements4.7 Medium
- elated-themes frappeFrappe Has Broken Access Control in its Workspace Save API5.1 Medium
- No product listedDataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting4.8 Medium
- thephpleague commonmarkLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass5.3 Medium
- thephpleague commonmarkleague/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes6.1 Medium
- misp cti-transmuteUnauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute5.1 Medium
- silverstripe silverstripe-cmsSilverstripe: XSS in breadcrumbs in page list view5.4 Medium
- statamic cmsStatamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template6.1 Medium
- wso2 api managerUser Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests4.3 Medium
- ail-project ail-frameworkStored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework6.9 Medium
- ail-project ail-frameworkStored Cross-Site Scripting in AIL Framework Domain Screenshot View6.9 Medium
- ail-project ail-frameworkAuthenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework8.2 High
- amir helzer woocommerce multilingual & multicurrencyWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- facebook for woocommerceWordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- mark jaquith subscribe to commentsWordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- facebook for wordpress, unknown facebook for wordpress +1 moreWordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- properfraction mailoptinWordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rank math seo math seoWordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…