CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields8.0 High
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import8.0 High
- unknown wp directory kitWP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields7.2 High
- automatic.cssAutomatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI6.4 Medium
- cotontiCotonti through 1.0.0 Reflected XSS via message.php lng parameter5.1 Medium
- cotontiCotonti through 1.0.0 Reflected XSS via search highlight parameter5.1 Medium
- horilla horilla-hrHorilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View8.5 High
- the wikimedia foundation mediawiki - wikilambda extensionStored i18n XSS in WikiLambda's VisualEditor integration4.8 Medium
- wikimedia foundation mediawiki - uploadwizard extensionUploadWizard Flickr collection and set titles allow DOM XSS5.3 Medium
- the wikimedia foundation mediawiki - wikibase extensionReflected XSS in Wikibase Special:SetLabel language validation5.3 Medium
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix4.8 Medium
- the wikimedia foundation mediawiki - cargo extensionCargo Exhibit field alias allows stored XSS6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS through Cargo Drilldown full-text search6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionAnonymous reflected XSS in CargoExport invalid-alias errors6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS in Cargo Drilldown hierarchy filters6.9 Medium
- krayin laravel-crmKrayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting5.1 Medium
- glpi-project glpiGLPI: Reflected XSS in dashboards7.5 High
- krayin laravel-crmkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting5.1 Medium
- zammadZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute6.3 Medium
- zammadZammad: Cross-Site Scripting in Ticket Notifications8.4 High
- the wikimedia foundation mediawiki - thanks extensionStored i18n XSS in the Flow integration of Thanks6.1 Medium
- foxit readerCVE-2026-183116.1 Medium
- foxit readerCVE-2026-183206.1 Medium
- foxit readerCVE-2026-183126.1 Medium
- invoiceplaneInvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms4.8 Medium
- sheshbabu zensheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting5.1 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS in Cargo Drilldown tab names2.3 Low
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- ail project frameworkStored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page6.3 Medium
- ail project frameworkStored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip8.5 High
- ail project frameworkStored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names5.1 Medium
- ail project frameworkStored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes8.5 High
- teldat regesta smart hd-plc - tldph16d2CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT4.8 Medium
- dashbitco lazy htmllazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS2.3 Low
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- novadigits technologies stockagileStored Cross-Site Scripting in StockAgile by Novadigits technologies5.1 Medium
- themifyme themify builderThemify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter7.2 High
- addonsorg repeater fields for elementor formsRepeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value7.2 High
- radykal fancy product designerFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter7.2 High
- flippercode wp maps – google maps, openstreetmap, mapbox, store locator with search, filters & listingsWP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter6.4 Medium
- jetmonsters restaurant menu and food orderingRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter7.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field7.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field6.4 Medium
- Show moreLoading…