CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- greg winiarski wpadvertsWordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 wpcsWordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- denis botić page visits counter – liteWordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- ashan perera eventonWordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- fahad mahmood wp docsWordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ankaref innovation and technology inc. librid/librefStored XSS in Ankaref's LIBRID/LIBREF5.4 Medium
- mispMISP: Unescaped HTML Injection in PDF Report Element Rendering5.1 Medium
- ankaref innovation and technology inc. librid/librefStored XSS Yönetim panel in Ankaref's LIBRID/LIBREF5.4 Medium
- wwbn avideoAVideo AD_Server Stored XSS via log.php label parameter9.3 Critical
- wwbn avideoAVideo LiveLinks Stored XSS via title and description fields9.3 Critical
- wwbn avideoWWBN AVideo Stored XSS via Category Name and Icon Class9.3 Critical
- wwbn avideoWWBN AVideo LoginControl Stored XSS via User-Agent Header9.3 Critical
- gohugo hugoHugo before 0.166.0 Cross-Site Scripting via text/org5.1 Medium
- gohugo hugoHugo before 0.166.0 Stored XSS via lineAnchors code block option5.1 Medium
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.48.6 High
- arubadev aruba hispeed cacheAruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content6.4 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value6.4 Medium
- shirasagi project shirasagiA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute...5.1 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface1.1 Low
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting6.1 Medium
- otwthemes sidebar manager lightSidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter7.2 High
- sunny johal easy google fontsEasy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field6.4 Medium
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting6.4 Medium
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting6.4 Medium
- saturday drive ninja forms - scheduled exportsNinja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters6.4 Medium
- No product listedFairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated...5.4 Medium
- No product listedItaltel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui...5.4 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Login Page index.php cross site scripting5.3 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system List DBOperation.php cross site scripting5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin8.7 High
- nationalsecurityagency skills-serviceNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover9.6 Critical
- decidimElection question titles allow stored script execution4.8 Medium
github.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go,govulncheck-vulndbopenSUSE +2 moreLF Edge eKuiper: Self-XSS in External Service Creation3.7 Low- drupal saml sso - service providerSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1473.3 Low
- drupal saml sso - service providerSAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1463.5 Low
- drupal safedeleteSafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1404.6 Medium
- drupal feed blockFeed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1374.2 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreFreeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url8.1 High
- grokability snipe-itSnipe-IT 8.6.3 Stored XSS via Department Names5.1 Medium
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via Asset Preview8.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via unescaped asset filenames8.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via Bazaar iconURL7.4 High
- siyuan-note siyuanSiYuan before v3.8.2 Stored XSS via notebook template paths8.4 High
- opentext™ documentum webtopDOM-based XSS vulnerability in OpenText™ Documentum Webtop4.8 Medium
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeCookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter7.2 High
- saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycredmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute6.4 Medium
- lumi h5p-nodejs-libraryStored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education5.2 Medium
- unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget5.4 Medium
- shaonsina sina extension for elementorSina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget6.8 Medium
- alex content maskContent Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles6.8 Medium
- Show moreLoading…