CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- cryout creations serious sliderSerious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute6.4 Medium
- bluemediapl autopayAutopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter7.2 High
- saadiqbal advanced file manager – ultimate file manager for wordpress and document library solutionAdvanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter6.1 Medium
- timwhitlock loco translateLoco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments6.4 Medium
- expresstech quiz and survey master (qsm) – quiz maker & survey makerQuiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter6.4 Medium
- wpmonks gravity booster – styles & layouts for gravity formsGravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter4.4 Medium
- weblizar admin custom loginAdmin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting4.4 Medium
- code-projects online shopping systemcode-projects Online Shopping System checkout.php cross site scripting5.1 Medium
- code-projects online food order systemcode-projects Online Food Order System edit_food_items.php cross site scripting5.1 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via Attribute-View Field Names9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via select option color9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via Template Calculation9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via Menu Metadata9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Remote Code Execution via PDF Annotations9.4 Critical
- sourcecodester online book store systemSourceCodester Online Book Store System System Settings index.php site_settings cross site scripting4.8 Medium
- dell ecsECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings5.4 Medium
- matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all formsInvisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter7.2 High
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeCookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter7.2 High
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter6.4 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter6.4 Medium
- vcita online booking & scheduling calendar by vcitaOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter7.2 High
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities6.3 Medium
- limesurveyLimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup8.5 High
- No product listedMigration-planner: credentialurl validator accepts javascript: urls6.3 Medium
- getgrav gravGrav before 2.0.13 Stored XSS via quoted-attribute bypass5.1 Medium
- getgrav gravGrav Form Plugin before 9.1.15 Stored XSS via Radio Toggle5.1 Medium
- gamerz wp-statsWP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting7.2 High
- pavex embed google photos albumEmbed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute6.8 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name7.2 High
- go standard library html/templateFix Javascript regexp context tracking in html/template6.1 Medium
- froiden worksuite saasWorksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields4.6 Medium
- django-helpdeskdjango-helpdesk < 2.3.3 Stored XSS via HTML Attachments5.3 Medium
- nodebbNodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name5.3 Medium
- dayuanjiang next-ai-draw-ioNext AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter5.1 Medium
- maalfer pentestifyStored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes5.1 Medium
- zimbra collaboration, synacor zimbra collaboration suite +1 moreIn Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability...6.1 Medium
- snstheme m.anh - fashion woocoommerce wordpress theme, samex - clean, minimal shop woocommerce wordpress theme +1 moreWordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability7.1 High
- ether etherpadEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)6.1 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- fifu.app featured image from urlWordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- brainstorm force suredashWordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- colissimo officiel : méthodes de livraison pour woocommerceWordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- magepeopleteam wpbookinglyWordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- multiparcels shipping for woocommerceWordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pickplugins accordionWordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- powerfulwp local delivery drivers for woocommerceWordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…