CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- sakaiproject sakaiSakai Conversations has a Stored XSS Issue8.7 High
- dolibarrDolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template5.1 Medium
- combodo itopCombodo iTop: Reflected XSS in dashboard revert8.9 High
- baserowBaserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name5.3 Medium
- johnson controls metasys 14, metasys 15 +1 moreImproper neutralization of input during web page generation ('cross-site scripting')...6.1 Medium
- horde impHorde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name5.1 Medium
- network optix nx witness vmsCross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name8.0 High
- ransomlookStored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook8.8 High
- grafana ossCVE-2026-17033 CVE Record6.8 Medium
- thembay urnaWordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- amplebyte pvt limited brave conversion engine (pro), brave conversion engine (pro) +1 moreWordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- goodlayers tourmasterWordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- franky events made easyWordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- blockart magazine blocksWordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- inisev social media & share iconsWordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- liquid web / stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- aa web servant 12 step meeting listWordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability7.1 High
- gohugo hugoHugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values4.8 Medium
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.55.3 Medium
- piwigoPiwigo Public Authentication cross site scripting2.3 Low
- hepta platforms heptabaseHepta Platforms｜Heptabase - Stored Cross-Site Scripting6.2 Medium
- No product listedA cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot...6.1 Medium
- emilstenstrom justhtmljusthtml before 3.11.0 XSS via selectedcontent projection5.1 Medium
- braveBrave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters7.1 High
- sourcecodester stock management systemSourceCodester Stock Management System getOrderReport.php cross site scripting5.3 Medium
- sourcecodester stock management systemSourceCodester Stock Management System printOrder.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting5.3 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.28.6 High
- wp chill image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute6.4 Medium
- dvankooten mc4wp: mailchimp for wordpressMC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages6.4 Medium
- joomgalleryfriends.net joomgallery extension for joomlaJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.08.6 High
- quantumcloud slider hero with video background, animationSlider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers8.8 High
- unknown post grid, slider & carousel ultimatePost Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field6.8 Medium
- perber leafwikiLeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)4.8 Medium
- combodo itopCombodo iTop: Reflected XSS in foreign key search criteria8.8 High
- typemillTypemill has Stored HTML Attribute Injection in Metadata Fields4.6 Medium
- combodo itopCombodo iTop: Reflected XSS in universal search8.0 High
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisreflected cross site scripting vulnerability in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS6.1 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS3.8 Low
- combodo itopCombodo iTop: Reflected XSS in tag admin8.0 High
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisstored cross site scripting issue in Esri Portal for ArcGIS5.5 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS5.4 Medium
- esri portal for arcgisHTML injection vulnerability in Esri Portal for ArcGIS3.5 Low
- yourlsYOURLS: Stored XSS in referrer statistics chart via crafted Referer header8.2 High
- Show moreLoading…