CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- gabe livan asset cleanup: page speed boosterAsset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- stellarwp wpcompleteWPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute6.4 Medium
- siyuan-note siyuanSiYuan through 3.8.4 Stored XSS via Heading Style Attribute8.6 High
- siyuan-note siyuanSiYuan through 3.8.4 Stored XSS via notebook names8.6 High
- openedx openedx-platformOpen edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)6.1 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.9 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.9 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.9 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.0 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.5.9 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.6 Critical
- red hat exploit intelligence, build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3 +6 more +8 moreIo.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus6.1 Medium
- @file-viewer doc, flyfish-dev file-viewer, msdoc-viewer +2 moreFile Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer8.2 High
- imzbf md-editor-v3md-editor-v3: XSS via fenced-code language rendering bypass6.1 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate5.1 Medium
- semanticmediawikiSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token6.1 Medium
- semanticmediawikiSemantic MediaWiki has a query debug output XSS (`DebugFormatter`)6.1 Medium
- semanticmediawikiSemantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS6.1 Medium
- semanticmediawikiSemantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)6.1 Medium
- semanticmediawikiSemantic MediaWiki has reflected XSS in Special:Ask plain table headers6.1 Medium
- semanticmediawikiSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes8.6 High
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent6.1 Medium
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent6.1 Medium
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent5.4 Medium
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent6.1 Medium
- ibm financial transaction manager for swift services for multiplatformsIBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.6.1 Medium
- concretecms-community-store community storeConcrete CMS Community Store before 2.7.8 Stored XSS8.6 High
- No product listedSveltyCMS SVG Media Upload media-service.server.ts cross site scripting5.1 Medium
- danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderPopup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter7.2 High
- danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderPopup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title6.4 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint5.4 Medium
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- complianz gdpr/ccpa cookie consent bannerComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex7.2 High
- wipeoutmedia css & javascript toolboxCSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields4.4 Medium
- synology diskstation manager (dsm)An improper neutralization of input during web page generation ('cross-site scripting')...5.4 Medium
- synology diskstation manager (dsm)An improper neutralization of input during web page generation ('Cross-site Scripting')...4.8 Medium
- ka informatics technologies ltd. co. bar association websiteReflected XSS in KA Informatics' Bar Association Website6.1 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.7.6 High
- qodeinteractive qi addons for elementorQi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter6.1 Medium
- ninjateam filebird – wordpress media library folders & file managerFileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting5.4 Medium
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content6.4 Medium
- wpchill strong testimonialsStrong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute6.4 Medium
- satollo newsletter – send awesome emails from wordpressNewsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter6.1 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name6.1 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta6.4 Medium
- qnap systems inc. qcalagentQcalAgent5.2 Medium
- wpdevelop booking calendarBooking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter6.1 Medium
- wpdevteam embedpress – pdf embedder, 3d pdf flipbook, google reviews, youtube videos, upload & embed pdf documentsEmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters6.1 Medium
- smub custom twitter feeds – a tweets widget or x feed widgetCustom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute6.4 Medium
- Show moreLoading…