CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedCute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper...6.1 Medium
- djust-org djustdjust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags5.1 Medium
- craftcms cmsCraft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields5.1 Medium
- wwbn avideoAVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header5.3 Medium
- dgtlmoon changedetection.iochangedetection.io through 0.60.6 Cross-Site Scripting via watch_title2.3 Low
- cisco identity services engine softwareCisco Identity Services Engine Cross-Site Scripting Vulnerability6.1 Medium
- changeweder crmChangeWeDer crm Save Endpoint customer.serve.js cross site scripting5.1 Medium
- adobe experience manager 6.5, experience manager 6.5 lts, experience manager as a cloud service +2 moreAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field7.7 High
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System Category Update update_category.php cross site scripting4.8 Medium
- No product listedPbootCMS Template Rendering ContentController.php decode_string cross site scripting5.1 Medium
- nuxt-content mdc@nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration8.1 High
- udecode plate@platejs/core HTML deserialization can trigger browser behavior during parsing6.1 Medium
- jenkins project gitee pluginJenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee...6.8 Medium
- jenkins project owasp dependency-check pluginJenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from...8.0 High
- jenkins project coverage pluginJenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results...8.0 High
- jenkins project warnings pluginJenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis...8.0 High
- advantech eki-1242eims, eki-1242ieims +1 moreNozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page...6.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab4.7 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.2 High
- themeisle visualizerVisualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source6.8 Medium
- thimpress learnpressLearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter7.1 High
- optimoleOptimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter8.8 High
- unknown xpro addons — 140+ widgets for elementor, xpro addons — 140+ widgets for elementor +1 moreXpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget6.8 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names6.8 Medium
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter6.1 Medium
- boldthemes bold page builderBold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter6.4 Medium
- codesupplyco advanced popupsAdvanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field6.4 Medium
- wp lab wp-lister lite for ebayWP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request7.2 High
- a2ui-project a2uia2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting5.1 Medium
- No product listedkkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The...6.1 Medium
- delinea secret server (on-prem)Reflected Cross-Site Scripting9.3 Critical
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks5.1 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields5.1 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages5.1 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers5.1 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names4.8 Medium
- netcore nr255-vNetcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi4.8 Medium
- webkul qloappsQloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode1.8 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format2.1 Low
- arubanetworks edgeconnect sd-wan orchestrator, hewlett packard enterprise (hpe) edgeconnect sd-wan gateways, hpe edgeconnect operating system +2 moreAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface5.5 Medium
- concrete cms cmsConcrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors2.3 Low
- concrete cms cmsConcrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard7.3 High
- concrete cms cmsConcrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names7.5 High
- concrete cms cmsConcrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views7.5 High
- ibm cloud pak for business automationMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.6.4 Medium
- ibm cloud pak for business automationMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.6.4 Medium
- Show moreLoading…