CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- kings plugins b2bking premiumWordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability7.1 High
- melograno venture studio wpdatatablesWordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- tagembedWordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs translatepressWordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- n8nn8n before 1.123.69 Stored XSS via Form Completion Page8.4 High
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.128.6 High
- phoca.cz phoca cart extension for joomlaJoomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.78.6 High
- phoca.cz phoca download extension for joomlaJoomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.45.3 Medium
- phoca.cz phoca cart extension for joomlaJoomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.75.3 Medium
- thinkingreed inc. f-revocrmF-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while...5.1 Medium
- themeum kirkiKirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload6.8 Medium
- ataur r gutenkitGutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload6.8 Medium
- bowo admin and site enhancements (ase)Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC6.8 Medium
- splunk soarStored Cross-Site Scripting (XSS) through Notes in Splunk SOAR4.0 Medium
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise5.4 Medium
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise7.1 High
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise5.7 Medium
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise7.3 High
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise5.7 Medium
- splunk, splunk enterprise +1 moreStored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise5.7 Medium
- splunk, splunk enterprise +1 moreCross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise6.8 Medium
- lemmynet lemmyLemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed6.4 Medium
- ether etherpadEtherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite9.6 Critical
- wekanWekan: Stored XSS in HTML board exports through a card-title second parse7.6 High
- netgate pfsense ce, pfsense plus +1 morepfSense Plus/CE Stored XSS via Traffic Graphs PTR Record5.3 Medium
- grokability snipe-itSnipe-IT: Stored DOM XSS via table selected-count IDs6.3 Medium
- drupal screenshotScreenshot - Critical - Unsupported - SA-CONTRIB-2026-1027.3 High
- drupal screenshotScreenshot - Critical - Unsupported - SA-CONTRIB-2026-1027.3 High
- getgrav grav-plugin-shortcode-coreGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers8.5 High
- humhubHumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason7.2 High
- open-emr openemrOpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler5.1 Medium
- open-emr openemrOpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal5.1 Medium
- humhubHumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering7.2 High
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.35.1 Medium
- humhubHumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation7.4 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input...4.6 Medium
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via pathName.ts9.3 Critical
- siyuan-note siyuanSiYuan XSS-to-RCE via unescaped block metadata in hint popup9.3 Critical
- reichertbrothers simplyrets real estate idxWordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- lcweb global galleryWordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- jeff starr bbq proWordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- stefano lissa newsletterWordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- wasiliy strecker contest galleryWordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- m-files corporation webCSS injection in M-Files Web4.8 Medium
- m-files corporation webHTML injection in M-Files Web5.1 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting7.2 High
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter7.2 High
- exactly www ewww image optimizerEWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content6.4 Medium
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter7.1 High
- Show moreLoading…