CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- spring security, vmware spring security +1 moreSpring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)8.2 High
- penpotPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTML8.7 High
- penpotPenpot: Stored XSS via custom font family name injected into a @font-face style rule7.6 High
- limesurveyLimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint7.4 High
- limesurveyLimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering7.2 High
- limesurveyLimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields4.8 Medium
- limesurveyLimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries8.4 High
devcode-it/openstamanagerPackagistOpenSTAManager has HTML Injection in modules/utenti/edit.php3.5 Low- librenmsLibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data7.1 High
- drupal slick carousel, slick carousel project carousel +1 moreSlick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-1176.1 Medium
- drupal monster menus, monster menus project menus +1 moreMonster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-1166.1 Medium
- address suggestion project suggestion, drupal address suggestion +1 moreAddress Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1034.8 Medium
- voxel51 fiftyoneFiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description7.0 High
- jihong88 suneditorSunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed8.5 High
- wpsoul greenshift – animation and page builder blocksGreenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI6.4 Medium
- designextreme reviews and rating – google reviewsReviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- muffingroup bethemeBetheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode6.4 Medium
- strategy11team formidable forms – wordpress form builder for contact forms, calculators, quizzes & moreFormidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter7.2 High
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks6.4 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings6.8 Medium
- emrevona wp fastest cache – wordpress cache pluginWP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header7.2 High
cockpitUbuntuCross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to...6.1 Medium- code-projects online shopping systemcode-projects Online Shopping System sumit_form.php cross site scripting5.3 Medium
- unknown wp fastest cacheWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning7.5 High
- creativeitem ekushey project manager crmEkushey Project Manager CRM 5.0 Stored XSS via System Name Field4.8 Medium
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.417.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)6.4 Medium
- hbshbs vulnerable to XSS via registerAsyncHelper output-escaping bypass8.1 High
- implecode ecommerce product catalogeCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4 Medium
- team-alembic ash authenticationReflected XSS in AshAuthentication confirmation and magic link interaction forms2.1 Low
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor6.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter7.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)7.2 High
- roxnor metform – contact form, survey, quiz, conditional forms, form templates & custom form builder for elementorMetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting6.4 Medium
- tagdiv composertagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute6.4 Medium
- roxnor fundengine – donation and crowdfunding platformFundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter6.1 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 700+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute6.4 Medium
- buildwps ppwp – password protect pagesPassword Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- vrana adminerAdminer before 5.4.3 Cross-Site Scripting via MySQL Version String5.3 Medium
- No product listedA Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit...5.4 Medium
- No product listedA Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit...6.1 Medium
- No product listedA Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall)...5.4 Medium
- No product listedA Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW ...5.4 Medium
- No product listedA Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW ...5.4 Medium
- mra13 stripe paymentsWordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- site building with toolset toolset blocksWordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- microsoft boostWordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…