CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- unknown social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title6.8 Medium
- 10web photo gallery by 10webPhoto Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters7.1 High
- unknown ultimate before after image slider & galleryBEAF < 4.7.19 - Author+ Stored XSS via Before Label6.8 Medium
- unknown ultimate before after image slider & galleryBEAF < 4.7.19 - Author+ Stored XSS via After Label6.8 Medium
- elegant themes diviDivi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode6.4 Medium
- opencartOpenCart Autocomplete Workflow edit.php cross site scripting5.1 Medium
- opencartOpenCart Autocomplete Workflow address.php cross site scripting5.1 Medium
- nocobaseNocoBase Rich Text Field Stored Cross-Site Scripting via API5.1 Medium
- bookstackapp bookstackBookStack before 26.05.4 Stored XSS via Drawing Upload9.3 Critical
- wwbn avideoAVideo Stored XSS via Live Schedule Title Description5.1 Medium
- apostrophecms apostropheApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass5.4 Medium
- svg svgoSVGO: removeScripts allows executable links through namespace and control-character bypasses8.2 High
- cypht-org cyphtCypht < 2.12.2 XSS via FROM Email Header in Contacts Module5.1 Medium
- svg svgoSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements6.1 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface8.4 High
- arubanetworks fabric composerUnauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface6.1 Medium
- arubanetworks fabric composerUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface8.8 High
- arubanetworks fabric composerAuthenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface9.0 Critical
- red hat ansible automation platform 2, satellite 6, update infrastructure 4 for cloud providers +1 more +3 morePulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content5.4 Medium
- rockwell automation armorstart® ltRockwell Automation ArmorStart® LT Stored Cross-site scripting6.9 Medium
- bootstrapped ventures wp recipe maker premiumWP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode6.4 Medium
- mozilla firefox, thunderbird +1 moreOther issue in the DOM: Navigation component6.1 Medium
- librenmsLibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP5.8 Medium
- librenmsLibreNMS before 26.5.0 Stored XSS via SNMP VRF fields5.3 Medium
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode6.4 Medium
- wpbakery page builderWPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter6.4 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter7.2 High
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode6.4 Medium
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)6.4 Medium
- wpdevteam betterdocs – ai documentation, knowledge base, mcp server, docs, wikis, faq & chatbotBetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content6.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter6.1 Medium
- worschtebrot affiliate super assistentAffiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function7.2 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute6.4 Medium
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode6.4 Medium
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute6.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute6.4 Medium
- webilia listdom: ai-powered business directory with classifieds ads listingsListdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter7.2 High
- suluSulu: Stored XSS via media download inline-disposition override5.4 Medium
- miniorange wordpress social login and registerWordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- iova.mihai slicewpWordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- the4 kalles addonsWordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- highwarden super store finderWordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- tailored media toolsWordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- acato email essentialsWordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown leadconnectorWordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- uncodeWordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- icegram email subscribers & newslettersWordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability7.1 High
- livewireLivewire DOM-based cross-site scripting during client-side state handling5.1 Medium
- unknown typoraTypora Mermaid Rendering cross site scripting5.3 Medium
- Show moreLoading…