CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wpblockart magazine blocks – blog designer, magazine & newspaper website builder, page builder with posts blocks, post gridMagazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute6.4 Medium
- miles all bootstrap blocksAll Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute6.8 Medium
- igms direct booking, unknown igms direct booking +1 moreiGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings8.8 High
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment8.8 High
- unknown easy form builder by whitestudioEasy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion8.8 High
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import6.8 Medium
- automattic wordpressWordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- bdthemes element pack addons for elementor – elementor widgets, elementor templates, elementor addons, live copy paste for elementor – cross domain copy paste & page duplicator, pixel gallery addons for elementor +4 more +6 moreBiggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API5.4 Medium
- themewant rt mega menu – mega menu builder for elementor & gutenbergRT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action6.4 Medium
- themewant rt mega menu – mega menu builder for elementor & gutenbergRT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute6.4 Medium
- No product listedCross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote...6.1 Medium
- themefusecom brizy – page builderBrizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter6.4 Medium
- webkul aureus erpAureus ERP through 1.6.0 Stored XSS via Payment Term Note5.1 Medium
- microsoft azure portalAzure Portal Spoofing Vulnerability8.2 High
- cubecart v6CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass4.8 Medium
- cubecart v6CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System6.1 Medium
- givanz vvvebVvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field7.6 High
- dataease sqlbotStored XSS via SVG Upload5.1 Medium
- opencast, polimediaupv paella-player +1 morePaella Player: Stored XSS via caption cue text8.7 High
- djust-org djustdjust: A template binding inherits a context safety grant it never earned (XSS)2.3 Low
djustPyPIdjust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)No score- mapserverMapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`5.3 Medium
- grafana oss, enterprise +1 moreCVE-2026-76154 CVE Record7.3 High
- m66b fairemailFairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)6.1 Medium
- chamilo chamilo-lmsChamilo LMS: Student-to-admin stored XSS in private messages via v-html9.0 Critical
- joni1802 ts3-managerTS3 Manager: Reflected XSS via /api/download port parameter steals operator session8.2 High
- mispMISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends8.5 High
- vendurehq vendureVendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions8.7 High
- siyuan-note siyuanSiYuan before 3.8.4 Cross-Site Scripting via Document Title8.6 High
- siyuan-note siyuanSiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels8.6 High
- pycontribs ansi2htmlansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 85.3 Medium
- wp inventory managerWordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- publishpress seriesWordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- property hive propertyhiveWordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetsearchWordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jettabsWordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepress it solutions llc visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown realtyna organic idx plugin + wpl real estateRealtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint7.1 High
- exactly www ewww image optimizerEWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion6.8 Medium
- unknown dictionaryDictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update8.8 High
- unknown dewa kirimDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates8.8 High
- unknown ht mega addons for elementorHT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag6.8 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs8.8 High
- unknown dictionaryDictionary <= 1.0 - Reflected XSS via Multiple Parameters7.1 High
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- Show moreLoading…