CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- synology chat serverAn improper neutralization of input during web page generation ('Cross-site Scripting')...9.0 Critical
- tangible loops & logicWordPress Loops & Logic - Reflected XSS6.5 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission7.2 High
- tsuyoshi saito soy gallerySOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed...4.8 Medium
- tsuyoshi saito soy calendarSOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed...4.8 Medium
- tsuyoshi saito soy calendarSOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed...4.8 Medium
- wpmet elementskit proElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter6.1 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute6.4 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes6.4 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field7.2 High
- getpocket pocketPocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. ...9.2 Critical
- wallabag android-appThe wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS...8.8 High
- wallabagwallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled...6.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute6.4 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter7.2 High
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser7.2 High
- envoyproxy envoyEnvoy: Stored XSS in Admin Stats Interface (/stats?format=html)7.4 High
- No product listedCross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before...6.1 Medium
- No product listedWordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event...5.4 Medium
- No product listedWordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To...4.8 Medium
- No product listedxipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject...5.4 Medium
- No product listedCross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute...6.1 Medium
- adobe dimensionDimension Stored XSS via Trusted CA Certificate Configuration4.8 Medium
- adobe dimensionWatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page4.6 Medium
- adobe dimensionDimension Stored XSS in Scheduled Report Task5.1 Medium
- elated-themes frappeFrappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description5.1 Medium
- triliumnext triliumTrilium: Note Import to RCE via Book Note9.3 Critical
- triliumnext triliumTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml9.3 Critical
- broadcom spring authorization server, spring authorization server +1 moreSpring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)8.2 High
- triliumnext triliumTrilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client9.3 Critical
- woylie doggoDoggo vulnerable to cross-site scripting via unescaped date field values5.3 Medium
- lutzroeder netronReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names...6.8 Medium
- lutzroeder netronReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names...6.8 Medium
- lutzroeder netronReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names...6.8 Medium
- seres software sywebReflected XSS in Seres Software's syWEB6.1 Medium
- flowintelFlowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes5.1 Medium
- bilpark informatics technologies industry and trade inc. doxbaseReflected XSS in BilPark's DoXBASE6.1 Medium
- flowintelFlowintel Stored XSS in Calendar via Malicious Case Title5.1 Medium
- flowintelFlowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content5.1 Medium
- siemens element maps-ng v47, element maps-ng v48, element maps-ng v49 +2 moreA vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component…7.0 High
- axew3 wp w3all phpbbWordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- loftocean cozystayWordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- codepeople music player for woocommerceWordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- codepeople cp media playerWordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp manage ninja fluent boards proWordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- realtyna organic idx pluginWordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- aa web servant 12 step meeting list12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log8.8 High
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia3.5 Low
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.15.3 Medium
- Show moreLoading…