CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- shahjahan jewel fluentcommunityWordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- aftership & automizely trackingWordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bestwebsoft profile extra fields by bestwebsoftWordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- codepress visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- lester chan wp-statsWordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability7.1 High
- bracketweb agrionWordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- ahmad geekybotWordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeisle wp full stripe freeWordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- echo plugins knowledge base for documentation, faqs with ai assistanceWordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp-buy visitors traffic real time statisticsWordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- 1meril blog floating buttonWordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability7.1 High
- lasso analytics, inc. do lassoWordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability7.1 High
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability7.1 High
- yonifre maspik – spam blacklistWordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pluginops mailchimp subscribe formsWordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- maalfer pentestifyStored Cross-site Scripting in Pentestify user account deletion via unescaped username5.1 Medium
- s9y serendipitySerendipity 2.3.5 Reflected XSS via search clean-URL route5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Cross-site Scripting via EscapedErrors6.1 Medium
- buildwps ppwp – password protect pagesPPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values7.2 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i8.9 High
- dartiss draft-listDraft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes6.5 Medium
- scada-lts scadalts, scada-lts +1 moreScadaLTS Unauthenticated Reflected XSS6.1 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- owen2345 camaleoncmsCamaleonCMS Stored XSS via Draft Post Title Creation Endpoint9.2 Critical
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.7 High
- ibm iIBM i is Affected By Stored Cross-site Scripting for i6.4 Medium
- nagios enterprises xi, nagios enterprises, llc. core, open source nagios core +2 moreNagios Core / XI DOM-based XSS via jsonquery.js5.1 Medium
- nagios enterprises xi, nagios enterprises, llc. core, open source nagios core +2 moreNagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter5.1 Medium
- squidfunk mkdocs-materialMaterial for MkDocs: DOM XSS in search suggestions via query parameter5.4 Medium
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI8.0 High
- librenmsLibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters5.4 Medium
- wintercms winterWinter: Stored XSS through Editor Settings custom styles8.1 High
- wintercms winterWinter: Stored XSS through Brand Settings custom styles8.1 High
- prowler-cloud prowlerProwler: Stored XSS in HTML reports through unescaped cloud resource tags5.4 Medium
- circl vulnerability-lookupStored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup6.1 Medium
- cal.com self-hosted (cal.diy)Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID9.3 Critical
- ultimate fosters pos (stock management & point of sale)Ultimate POS Stored XSS via First Name Field in Leave Notifications4.8 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget5.4 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart6.1 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name5.4 Medium
- unknown patterns kitPatterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link5.4 Medium
- jazzband tablibtablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title4.8 Medium
- sonicwall gmsMultiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044...6.1 Medium
- Show moreLoading…