CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- silverplugins217 calculation for contact form 7WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- underconstructionpage under constructionWordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability7.1 High
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- villatheme product variations swatches for woocommerceWordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- silverks grapheneWordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mispMISP Dashboard Button Widget Allows Persistent JavaScript URL Injection5.3 Medium
- mispReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters6.1 Medium
- netgate pfsense plus, pfsense ce +1 morepfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php5.1 Medium
- netgate pfsense plus, pfsense ce +1 morepfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php5.1 Medium
- netgate pfsense plus, pfsense ce +1 morepfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php5.1 Medium
- kriesi enfoldWordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability5.8 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.55.3 Medium
- wwbn avideoAVideo Reflected XSS via cancelUri in userLogin.php5.3 Medium
- wwbn avideoAVideo Reflected XSS via videoEmbeded.php link parameter5.3 Medium
- ocs inventory ng ocsreportsMultiple vulnerabilities in Ocsreports for OCS Inventory NG9.2 Critical
- elegant themes diviDivi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter6.4 Medium
- ataurr gutenkit – page builder blocks, patterns, and templates for gutenberg block editorGutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'6.4 Medium
- langgenius difylanggenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting5.1 Medium
- langgenius difylanggenius dify Splash Layout splash.tsx router.replace cross site scripting5.3 Medium
- seowritingSEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload5.1 Medium
- drupal photoswipe - responsive javascript modal image galleryPhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1314.6 Medium
- drupal email verification / sms verification / otp verificationEmail Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-1255.4 Medium
- drupal component blocksComponent blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-1234.6 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-1193.1 Low
- jenkins project update-center2Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names,...5.4 Medium
- jenkins project customizable header pluginJenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin...8.8 High
- jenkins project sonarqube scanner pluginJenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard...8.0 High
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log...8.8 High
@tiptap/corenpmTiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes6.4 Medium- unknown livejournal shortcodeLiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode5.9 Medium
- unknown xpro addonsXpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets6.8 Medium
- unknown all in one seoAll in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block6.8 Medium
- unknown icegram expressIcegram Express < 5.8.6 - Admin+ Stored XSS3.5 Low
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- estatikWordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- trustedsiteWordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- interactivegeomaps interactive geo mapsWordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sonaar mp3 audio player for music, radio & podcast by sonaarWordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via incomplete asset blocklist8.6 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name4.8 Medium
- wpmu dev - your all-in-one wordpress platform broken link checkerBroken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log7.2 High
- tymotey easy waveform playerEasy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function6.4 Medium
- marcus login with ajaxWordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- elegant themes diviDivi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter6.4 Medium
- jeff starr simple ajax chatSimple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification8.8 High
- ays pro faq builder aysFAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information8.8 High
- metagauss registrationmagicRegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field7.5 High
- unknown social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler7.1 High
- Show moreLoading…