CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter7.2 High
- sslzen ssl zen — ssl certificate installer & https redirectsSSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter6.1 Medium
- tomdever wpforo forumwpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field6.4 Medium
- smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & moreWPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter6.1 Medium
- bmarshall511 zero spam for wordpressZero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration7.2 High
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name6.4 Medium
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute6.4 Medium
- bookingalgorithms ba book everythingBA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter7.2 High
- htplugins ht contact form – drag & drop form builder for wordpressHT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume7.2 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter6.4 Medium
- radykal fancy product designerFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field6.1 Medium
- radykal fancy product designerFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta7.2 High
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation7.2 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')6.4 Medium
- unknown link libraryLink Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links6.1 Medium
- itflowITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser...8.0 High
- wipeoutmedia css & javascript toolboxCSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode6.4 Medium
- cyber-iii student-management-systemningzichun student-management-system addLog.php echo cross site scripting5.3 Medium
- madpsy ka9q ubersdrmadpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the...5.4 Medium
- No product listedA reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of...5.4 Medium
- No product listedCross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to...6.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description5.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field5.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field5.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Lead Title5.1 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting5.3 Medium
- starcitizenwiki mediawiki-extensions-embedvideoMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled7.5 High
- code16 sharpcode16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute7.3 High
- code16 sharpcode16/sharp has a stored XSS via data-html-content Sanitizer Bypass8.7 High
- foundry376 mailspringMailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)6.1 Medium
- cstigler node-xhtml-purifierxhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS6.1 Medium
- volotat anagnorisisvolotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting5.1 Medium
- discourseDiscourse: Encode action_code_who in mention URLs6.4 Medium
- discourseDiscourse: Chat upload filenames rendered as raw HTML in excerpts5.0 Medium
- discourseDiscourse: Stored HTML injection in video notification emails5.4 Medium
- discourseDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized users8.7 High
- grokability snipe-itSnipe-IT: Stored XSS via Custom Field name in asset-list column headers8.1 High
- grokability snipe-itSnipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API8.7 High
- the wikimedia foundation mediawiki - cirrussearch extensionReflected XSS in CirrusSearch debug explain output5.5 Medium
- excalidrawExcalidraw Imported File restore.ts cross site scripting5.3 Medium
- thorsten phpmyfaqphpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission8.2 High
- opentext vendor invoice management for sap solutionsStored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application7.3 High
- webkul aureus erpAureus ERP 1.6.0 Stored XSS via SVG File Upload5.1 Medium
- paessler prtg network monitorReflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor5.1 Medium
- magazine3 wp multilang – translation and multilingual pluginWP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content6.4 Medium
- papercut hivePaperCut Hive Embedded App for Ricoh: Javascript injection3.8 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category6.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview6.8 Medium
- radiustheme the post gridThe Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening3.5 Low
- Show moreLoading…