CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- huanzi-qch base-adminhuanzi-qch base-admin Add User CommonController.java save cross site scripting5.1 Medium
- No product listedSEMCMS KindEditor Upload upload_json.php cross site scripting5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…8.7 High
- openc3 cosmosOpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget7.6 High
- themefic ultimate addons for contact form 7WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pixelyoursite – your smart pixel (tag) managerWordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepeople calculated fields formWordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- mohammed kaludi core web vitals & pagespeed boosterWordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability7.1 High
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- secondlinethemes podcast importer secondlineWordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- radiustheme the post gridWordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- radiustheme the post gridWordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- roxnor elementskit elementor addons liteWordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- metaphorcreations dittyWordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rustaurius ultimate faqWordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- razorpay payment buttonWordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- leap13 premium blocks – gutenberg blocks for wordpressWordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability7.1 High
- tomdever wpforo forumWordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nicolaskulka wps limit loginWordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jettricksWordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- limesurveyLimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name7.4 High
- drupal diba carousel sliderDiba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-1914.6 Medium
- limesurveyLimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings7.4 High
- drupal cookiecuttrCookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1813.5 Low
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1724.6 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1634.6 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1604.2 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1594.6 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1584.6 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1554.6 Medium
- drupal webformWebform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-1543.5 Low
- humhubHumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover7.2 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.3 Critical
- redaxo, opnsense core +1 moreREDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames4.8 Medium
- redaxo, opnsense core +1 moreREDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`4.8 Medium
- jihong88 suneditorSunEditor: Critical XSS vulnerability - sanitizer bypass10.0 Critical
- doccms administration panelMultiple vulnerabilities in the Microweber administration panel5.9 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms6.1 Medium
- tauriTauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains8.3 High
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl6.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Improper escaping in the XSS Webconsole plugin6.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: XSS possible through XSSAPI.getValidHref()6.1 Medium
- jetmonsters getwid – gutenberg blocksGetwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'6.4 Medium
- unknown subscribe formsSubscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting6.8 Medium
- js morisset jsm show post metadataJSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key6.8 Medium
- unknown happyaddons for elementorHappy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget6.8 Medium
- Show moreLoading…