CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite7.2 High
- quadlayers social chat – click to chat app buttonSocial Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box6.4 Medium
- dearhive dearflip – pdf flipbook, 3d flipbook, pdf embed, pdf viewerDear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes5.4 Medium
- dearhive dearflip – pdf flipbook, 3d flipbook, pdf embed, pdf viewerDear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute6.4 Medium
- emlogEmlog: Stored XSS via Tag Name in Article Editor6.9 Medium
- emlogEmlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized8.7 High
- stormshield network securityPossible XSS in the SNS web administration panel4.3 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust6.1 Medium
- yordam information technology consulting, training and electronic systems industry and trade inc. library information and document automation programHTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System6.1 Medium
- gastromenum ticket and qr menu systemStored XSS in Gastromenum's Gastromenum Ticket and QR Menu System5.4 Medium
- yordam information technology consulting, training and electronic systems industry and trade inc. library information and document automation programReflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System6.1 Medium
- menulux software inc. portalStored XSS in Menulux Software's Menulux Portal5.4 Medium
- openpanel-dev openpanelOpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy8.4 High
- getgrav gravGrav Admin before 2.0.20 Cross-Site Scripting via marked.js5.1 Medium
- getgrav grav-plugin-admin2Grav Admin before 2.0.21 Stored XSS via username5.1 Medium
- getgrav grav-plugin-shortcode-coreGrav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters5.1 Medium
- getgrav gravGrav 2.0.0 through 2.0.17 Stored XSS via Modular Pages5.1 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.8 Stored XSS via html_entity_decode5.1 Medium
- wwbn avideoAVideo userLogin.php Reflected XSS via error parameter5.3 Medium
- interinfo dreammakerInterinfo｜DreamMaker - Reflected Cross-site Scripting4.8 Medium
- xtemos woodmartWordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apache software foundation alluraApache Allura: Stored XSS via code repositories6.1 Medium
- apache software foundation skywalkingApache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)6.1 Medium
- apache software foundation alluraApache Allura: Stored XSS via markdown HTML processing6.1 Medium
- eleveo quality managementEleveo Quality Management Conversation Review cross site scripting5.1 Medium
- eleveo call recording softwareEleveo Call Recording Software roleAddAction.do cross site scripting5.1 Medium
- light0011 cmslight0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting5.3 Medium
- emxtecnologia gestao x business suiteA reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business...8.7 High
- emxtecnologia gestao x business suiteEMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability...8.7 High
- No product listedCross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE...5.4 Medium
- No product listedCross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore...6.1 Medium
- No product listedCross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26...5.4 Medium
- No product listedIn Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross...7.1 High
- No product listedIn Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is...5.4 Medium
- No product listedItaltel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui...5.4 Medium
- themoos core-moosMOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting5.3 Medium
- maplibre maplibre-gl-jsMapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip10.0 Critical
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System index.php cross site scripting5.1 Medium
- thimpress learnpressLearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles5.1 Medium
- magepeople inc. booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpkoi wordpress themes templates for elementor, wpkoithemes wpkoi templates for elementor +1 moreWordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brightvesseldev quick event managerWordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability7.1 High
- wordplus bp better messagesWordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability7.1 High
- veronalabs wp statisticsWordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability6.1 Medium
- exactly www ewww image optimizerWordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability7.2 High
- john havlik breadcrumb navxtWordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- rometheme rtmkitWordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- advanpix wp quicklatexWordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- ninja forms file uploads extension, saturday drive ninja forms file uploads extension +1 moreWordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…