CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters7.1 High
- crocoblock jetengineJetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload6.8 Medium
- mitchell bennis simple file listSimple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description8.8 High
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback7.1 High
- nabil lemsieh easy media replaceEasy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title6.8 Medium
- unknown booking calendar, appointment booking systemBooking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload8.8 High
- unknown 10web boosterTenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass4.7 Medium
- extra innovation inc. acmailer cgi, acmailer db +1 moreA cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute...5.1 Medium
- siteground speed optimizer – the all-in-one performance-boosting pluginSpeed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes6.4 Medium
- publishpress seriesWordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dartiss draft listWordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- atlassian confluence data center, confluence server +1 moreThis Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration...8.6 High
- truelockmc streambertStreambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer6.9 Medium
- librenmsLibreNMS before 26.7.0 Stored XSS via Oxidized API9.2 Critical
- librenmslibrenms before 26.7.0 Stored XSS via graph_descr settings4.8 Medium
- koha community kohaKoha Stored XSS via Purchase Suggestion Handler5.1 Medium
- froxlorFroxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover8.7 High
- otalio ship property management systemCross-site scripting in Otalio Ship Property Management System6.7 Medium
- foremForem: Stored XSS in Admin Abuse Report Rendering6.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.25.1 Medium
- mybbMyBB: Profile field type confusion XSS8.7 High
- mybbMyBB: Buddy/ignore list username XSS8.7 High
- kestra-io kestraKestra: Stored XSS via custom Markdown [[link]] attribute injection8.7 High
- triliumnext triliumTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app8.3 High
- unknown subscribe2WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability7.1 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic contact form by supsysticWordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- kaizencoders url shortifyWordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpzoom recipe card blocks for gutenberg & elementorWordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- notfound chaty proWordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mra13 affiliates managerWordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability7.1 High
- miniorange wordpress social login and registerWordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- magazine3 wp multilangWordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability7.1 High
- autopayWordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- shahjada wpdm – premium packagesWordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp grids easytest – simplify a/b testingWordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdeveloper templatelyWordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- mythemeshop wp tab widgetWordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- achal jain table of contents blockWordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- 93digital typing effectWordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- unknown wufoo shortcodeWordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- deepen bajracharya video conferencing with zoomWordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marcus (aka @msykes) login with ajaxWordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpzoom forms – contact form plugin for gutenbergWordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shabti frontend admin by dynamiappsWordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- alex featured video plusWordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…