CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- marcin wise chatWordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeum kirkiWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- mapsteps ug ultimate dashboard pro, ultimate dashboard pro +1 moreWordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- wordplus bp better messagesWordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability7.1 High
- teconcetheme mayosis coreWordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ssl zen zen, unknown ssl zen +1 moreWordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mohamed magdy quill formsWordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- cure53 dompurifyDOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook5.1 Medium
- getgrav gravGrav before 2.0.14 Stored XSS via Invalid UTF-8 Byte5.1 Medium
- getgrav gravGrav before 2.0.15 Stored XSS via audio/video source URL5.1 Medium
- getgrav gravGrav before 2.0.15 Stored XSS via detectXss() Quote Bypass9.3 Critical
- getgrav gravGrav Form Plugin before 9.1.19 Stored XSS via Field Properties5.1 Medium
- getgrav gravGrav plugin-api before 1.0.15 Script Injection via SVG5.1 Medium
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via malicious filename upload9.3 Critical
- fileorbis informatics services trade inc. fileorbisStored XSS in Fileorbis Informatics's FileOrbis5.4 Medium
- smicallef spiderfootSpiderFoot Stored Cross-Site Scripting via Correlation Titles9.3 Critical
- mdmag quill forms | conversational multi step forms, surveys & quizzesQuill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- No product listedA reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote...6.1 Medium
- No product listedA reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote...6.1 Medium
- No product listedCross-site scripting vulnerability in the user documentation field in Beta Systems Software AG...6.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting5.3 Medium
- pandora-analysis pandoraStored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora7.0 High
- pandora-analysis pandoraStored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora6.9 Medium
- apostrophecms apostropheApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close6.1 Medium
- stirling-tools stirling-pdfStirling PDF: Stored XSS in Info Summary8.1 High
- ether etherpadEtherpad: Stored XSS in HTML export via unescaped attribute-pool values5.3 Medium
- jetbrains pycharmIn JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible4.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was...8.2 High
- discourseDiscourse: Cache poisoning/XSS via color scheme cookies9.3 Critical
- opentext directory servicesHTML Injection in OTDS Swagger UI7.3 High
- bulwarkmail webmailIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was...5.4 Medium
- bulwarkmail webmailIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading...7.2 High
- bankpro e-service technology service centerDOM-based Cross-Site Scripting in OutSystems Service Center4.8 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Stored XSS via assets endpoint9.4 Critical
- code-projects online shopping systemcode-projects Online Shopping System offersmail.php cross site scripting5.3 Medium
- webkul bagistoWebkul Bagisto RMA Message send-message cross site scripting5.1 Medium
- No product listedCross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute...6.1 Medium
- No product listedCross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker...6.1 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action7.2 High
- boldthemes bold page builderBold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- infility globalInfility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint7.2 High
- unknown masteriyo lmsMasteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description6.1 Medium
- elegant themes diviDivi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL5.4 Medium
- smub smash balloon social post feed – simple social feeds for wordpressSmash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- aliakro snippet shortcodesSnippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- brainstormforce suredash – community, courses & member dashboardSureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute6.4 Medium
- emarket-design video gallery – youtube gallery, playlist & video gridVideo Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode6.4 Medium
- toocheke companionToocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta6.4 Medium
- Show moreLoading…