CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- jgraph drawiodraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-466426.1 Medium
- metaphor creations dittyDitty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute5.1 Medium
- webkul aureus erpAureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log5.1 Medium
- uvdesk core-framework, community-skeleton +1 moreUVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer5.1 Medium
- mispMISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu6.3 Medium
- mispStored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index6.3 Medium
- hyve5 leantimeHyve5 Leantime Project Dashboard show.blade.php cross site scripting4.8 Medium
- hyve5 leantimeHyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting5.1 Medium
- 1millionbot ai chatbot platform (saas) de 1millionbot.Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform5.1 Medium
- mispStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name6.3 Medium
- omega solution hrm osOmega Solution HRM OS SVG File Upload view cross site scripting4.8 Medium
- xuxueli xxl-jobxuxueli xxl-job Task Management JobInfoController.java cross site scripting5.1 Medium
- No product listedidccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.7.1 High
- No product listedEMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.6.1 Medium
- No product listedStencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the...6.1 Medium
- No product listedCuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the...5.2 Medium
- No product listedCuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the ...5.8 Medium
- No product listedCross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated...6.1 Medium
- newbee-ltd newbee-mallnewbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System index.php cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Password Change change_password cross site scripting5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System User Management add_user cross site scripting5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System add_symptom cross site scripting4.8 Medium
- code-projects assessment managementcode-projects Assessment Management add-single-mark.php cross site scripting5.1 Medium
- code-projects assessment managementcode-projects Assessment Management add-user.php cross site scripting4.8 Medium
- code-projects assessment managementcode-projects Assessment Management User Editing edit-user.php cross site scripting4.8 Medium
- themeum kirkiKirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload6.8 Medium
- averta master sliderMaster Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes6.8 Medium
- olivier-ls php-ftsolivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting5.1 Medium
- honojs honohono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings2.3 Low
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter4.7 Medium
- ysinnovations ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribersYS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input6.4 Medium
- celomitan gum addon for elementorGum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting6.4 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input6.4 Medium
- creativeinteractivemedia real3d flipbook – 3d flipbook, pdf flipbook, pdf viewer, pdf embedderReal 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute6.4 Medium
- dvankooten mc4wp: mailchimp for wordpressMC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag6.1 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input6.4 Medium
- xootix otp login & register woocommerceOTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting4.4 Medium
- ghozylab wp composer – the easiest page builderWP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode6.4 Medium
- sslzen ssl zen — ssl certificate installer & https redirectsSSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters6.1 Medium
- appmysite – wordpress & woocommerce mobile app builder (no-code android & ios app maker)AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler6.4 Medium
- mdmag quill forms | conversational multi step forms, surveys & quizzesQuill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value7.2 High
- bompus wp customer reviewsWP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter6.1 Medium
- unknown master blocksMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings8.8 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title8.8 High
- unknown estatik real estate pluginEstatik < 4.3.5 - Reflected XSS via get_listings hash Parameter7.1 High
- unknown business name generatorBusiness Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting3.5 Low
- wppochipp pochippPochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter6.1 Medium
- f1logic wp2social auto publishWP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter4.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters6.1 Medium
- Show moreLoading…