CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chouby polylangWordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- premmerce permalink manager for woocommerceWordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpfunnelsWordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- jtsternberg cmb2WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess virtue/ascend/pinnacle toolkitWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- visual composer website builderWordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kreatura layersliderWordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability5.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- themerex addonsWordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themerex addonsWordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- ad inserter inserter, spacetime ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- exactly www ewww image optimizerWordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- happyformsWordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability7.1 High
- man4toman parsi dateWordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- posimyth the plus addons for elementor page builder liteWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- awesomesupport awesome supportWordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- bobbingwide oikWordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- vendidero trusted shops easy integration for woocommerceWordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- wc product table woocommerce product table liteWordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- pixfort coreWordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability5.4 Medium
- unknown yith woocommerce ajax searchWordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- radiustheme classified listingWordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- alekv pixel manager for woocommerceWordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- lukeseager wordpress persistent loginWordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- veronalabs wp statisticsWordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- rainafarai notification for telegramWordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- ilghera jw player for wordpressWordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- leevio happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- qode qi addons for elementorWordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mispMISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image8.3 High
- moodleMoodle: xss via password reset link due to insufficient username escaping4.3 Medium
- moodleMoodle: xss in forum post templates due to insufficient escaping4.6 Medium
- digiwin easyflow .netDigiWin｜EasyFlow .NET - Reflected Cross-site Scripting5.1 Medium
- rockiger reactpress – create react app for wordpressReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter6.4 Medium
- ahsangadit viable url media uploaderViable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- kazukiyanamoto post views stats counterPost Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header7.2 High
- rameez iqbal real estate manager – property listing and agent managementReal Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute6.4 Medium
- boldthemes bold page builderBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute6.4 Medium
- Show moreLoading…