CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedSilverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library...6.1 Medium
- No product listedSilverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image...6.1 Medium
- No product listedSilverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management...6.1 Medium
- No product listedAn authenticated stored cross-site scripting (XSS) vulnerability in the Column Management...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization...3.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to...4.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was...5.4 Medium
- thephpleague commonmarkcommonmark before 2.9.1 XSS via AttributesExtension form feed bypass6.9 Medium
- mispMISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs5.1 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field7.2 High
- standard notes notesXSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import6.9 Medium
- code-projects hospital information systemcode-projects Hospital Information System Patient Management editPatient.php cross site scripting5.1 Medium
- codesupplyco powerkit – supercharge your wordpress sitePowerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing6.4 Medium
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting5.3 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting5.3 Medium
- sfturing ssm prosfturing ssm_pro Order Endpoint OrderController.java cross site scripting5.3 Medium
- No product listedFastAdmin User Controller User.php login cross site scripting5.3 Medium
- code-projects online examination systemprojectworlds Online Examination System Feedback Form feedback.php cross site scripting5.3 Medium
- projectwolds online attendance systemProjectwolds Online Attendance System profile.php cross site scripting5.1 Medium
- code-projects hotel and tourism reservation in phpcode-projects Hotel and Tourism Reservation in PHP details.php cross site scripting5.3 Medium
- code-projects task management systemcode-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting5.1 Medium
- themeum kirkiKirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding7.5 High
- boldthemes bold page builderBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings6.8 Medium
- wwbn avideoAVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting6.9 Medium
- sc0ttkclark pods – custom content types and fieldsPods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute6.4 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header7.2 High
- fooplugins gallery : foogalleryGallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute6.4 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter6.1 Medium
- elegant themes diviDivi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter6.4 Medium
- themovation quickcalQuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters7.2 High
- boldgrid w3 total cacheW3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator7.2 High
- brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quizSureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload7.2 High
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key7.2 High
- gravity forms formsGravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value7.2 High
- cleantalk spam protection, honeypot, anti-spam by cleantalkSpam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder7.2 High
- the beaver builder team beaver builder plugin (starter version)Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter6.1 Medium
- hasthemes ht menuHT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings8.0 High
- samuel marshall jch optimizeJCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override8.0 High
- unknown joli table of contentsJoli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute6.8 Medium
- unknown catfolders document gallery & pdf libraryCatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute6.8 Medium
- unknown vikwidgetsloaderVikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix6.8 Medium
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget6.8 Medium
- boldthemes bold page builderBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes6.8 Medium
- boldthemes bold page builderBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL6.8 Medium
- unknown greenshiftGreenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute6.8 Medium
- unknown masteriyo lmsMasteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields6.8 Medium
- unknown ipgp visitors originIPGP Visitors Origin < 1.6 - Reflected XSS7.1 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails4.7 Medium
- unknown joli table of contentsJoli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS3.5 Low
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- Show moreLoading…