CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block6.4 Medium
- devitemsllc ht mega addons for elementor – elementor widgets & template builderHT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter6.4 Medium
- basercms user community basercmsA stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.5.1 Medium
- basercms user community basercmsA stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web brow…5.1 Medium
- basercms user community basercmsA cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.5.1 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API8.8 High
- keywordrush content eggContent Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue6.8 Medium
- freshlight lab wp mobile menuWP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF7.1 High
- creative motion robin image optimizerRobin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser7.5 High
- unknown hostinger reachHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute6.8 Medium
- unknown all in one files uploadAll in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload8.8 High
- unknown audio player blockAudio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL6.8 Medium
- unknown embedpressEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute6.8 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields3.5 Low
- wpshuffle frontend post submission manager lite – guest post and frontend submission formsFrontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)7.2 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting5.3 Medium
- the wikimedia foundation mediawiki - centralnotice extensionStored i18n XSSs in CentralNotice6.1 Medium
- the wikimedia foundation mediawiki - massmessage extensionStored i18n XSS in MassMessage6.1 Medium
- the wikimedia foundation mediawiki - cargo extensionXSS in Cargo's Special:CargoQuery page due to unsanitized table headers6.1 Medium
- the wikimedia foundation mediawiki - centralauth extensionXSS through i18n message in CentralAuth6.1 Medium
- the wikimedia foundation mediawiki - refreshed skinXSS in Refreshed skin6.1 Medium
- the wikimedia foundation mediawiki - wikilambda extensionWikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML6.1 Medium
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT Cross-site Scripting4.8 Medium
- lantronix g520 seriesLantronix G520 Series Cellular Gateway Cross-site Scripting7.7 High
- google chromeCross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker...6.1 Medium
- jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard8.1 High
- jupyterlab, jupyterlab jupyterlite-core +1 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)6.8 Medium
- oauthlibOAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation6.1 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.48.6 High
- the wikimedia foundation mediawiki - wikibase extensionStored XSS on Wikibase Special:SetSiteLink via unescaped system message6.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- wikimedia foundation mediawiki - wikiseo extensionStored XSS in WikiSEO author and image properties on action=info6.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- joomla joomla\!, joomla! project cms, framework filter package +2 moreJoomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.37.1 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- joomla joomla\!, joomla! project cms, framework filter package +2 moreJoomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.37.1 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.35.9 Medium
- wikimedia foundation mediawiki - flow extensionFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS6.1 Medium
- yahoo serialize-javascriptSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies2.3 Low
- webminWebmin: Reflected XSS in the Configuration module9.6 Critical
- pretixHTML injection2.1 Low
- hewlett packard enterprise hpe oneviewHPE OneView - Cross-site scripting vulnerability8.2 High
- hewlett packard enterprise hpe oneviewHPE OneView - Cross-site scripting vulnerability8.2 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- coolbeans1212 mateishomepage-websitecoolbeans1212 MateisHomePage-Website users.php cross site scripting5.3 Medium
- codecanyon rocket lmsCodeCanyon Rocket LMS Student Profile Image Upload cross site scripting5.1 Medium
- mwasikz robo-cafe-rmsmwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting5.1 Medium
- Show moreLoading…