CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- cisa malcolmCross-site Scripting in Malcolm5.3 Medium
- smgdkngt dobaseStored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)6.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block4.8 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags5.1 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description5.8 Medium
- visual composer website builderWordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- boldthemes bold page builderWordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- concrete cms cmsConcrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title6.0 Medium
- ideasoft software industry and trade inc. smart e-commerceReflected XSS in IdeaSoft's Smart E-Commerce6.1 Medium
- chamilo chamilo-lmsChamilo LMS Stored XSS via Survey Answer Submission in reporting.php5.3 Medium
- wwbn avideoAVideo Bookmark Plugin Stored XSS via Chapter Names9.3 Critical
- wwbn avideoAVideo LoginControl Stored XSS via PGP Public Key9.3 Critical
- wwbn avideoAVideo CustomizeUser Stored XSS via field_name Parameter9.3 Critical
- wwbn avideoAVideo Stored XSS via donationLink in watch page button9.3 Critical
- wwbn avideoAVideo YPTWallet Stored XSS via CryptoWallet Configuration9.3 Critical
- wwbn avideoWWBN AVideo Reflected XSS via Gallery Category getBackURL5.3 Medium
- wwbn avideoWWBN AVideo Stored XSS via UserGroups setGroup_name9.2 Critical
- wwbn avideoWWBN AVideo Reflected XSS via confirmLivePassword.php5.3 Medium
- wwbn avideoWWBN AVideo Reflected XSS via confirmLivePassword.php5.3 Medium
- wwbn avideoWWBN AVideo Reflected XSS via Referer Header Comment Breakout5.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter7.2 High
- david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import6.4 Medium
- david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter6.4 Medium
- david lingren media library assistantMedia Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter6.4 Medium
- unknown featured image with urlFeatured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text6.8 Medium
- unknown ai builderAI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript6.8 Medium
- unknown gutenverse newsGutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content8.8 High
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration5.4 Medium
- unknown coolclockCoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute6.8 Medium
- unknown translate wordpress with gtranslateGTranslate < 3.0.10 - Admin+ Stored XSS3.5 Low
- unknown coolclockCoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON6.8 Medium
- themifyme themify – woocommerce product filterThemify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting6.1 Medium
- boldthemes bold timeline liteBold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- comesio relevanssi – a better searchRelevanssi <= 4.28.1 - Reflected Cross-Site Scripting6.1 Medium
- realmag777 husky – products filter for woocommerce professionalHUSKY <= 1.4.3 - Reflected Cross-Site Scripting6.1 Medium
- cbutlerjr wp-members membership pluginWP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting6.1 Medium
- fernandot vigilant – 100% free security suite: firewall, 2fa, login, headers, scanner…Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- specialk simple ajax chat – add a fast, secure chat boxSimple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting7.2 High
- premio floating chat widget: contact chat icons, telegram chat, line messenger, wechat, email, sms, call button – chatyFloating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting6.1 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting6.1 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting7.2 High
- flextypeFlextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory2.4 Low
- No product listedA reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta...6.1 Medium
- angularAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements8.6 High
- angularAngular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements8.6 High
- angularAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler5.3 Medium
- mintplex-labs anything-llmAnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator5.5 Medium
@eigenpal/docx-editor-reactnpm,@eigenpal/docx-editor-corenpm +1 more@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name8.1 High- Show moreLoading…