CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field7.2 High
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields7.2 High
- davidanderson redux frameworkRedux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field6.4 Medium
- optimizingmatters autoptimizeAutoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path7.2 High
- codepeople calculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & moreCalculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()6.1 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)6.1 Medium
- inisev social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL6.1 Medium
- five star plugins star restaurant reviews, unknown five star restaurant reviews +1 moreFive Star Restaurant Reviews < 2.3.14 - Reflected XSS7.1 High
- unknown if-so dynamic contentIf-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name3.1 Low
- unknown if-so dynamic contentIf-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes4.7 Medium
- codename065 download managerDownload Manager < 3.3.71 - Author+ Stored XSS via Package Icon6.4 Medium
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback7.5 High
- extendifyExtendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key7.2 High
- hclsoftware digital experienceHCL Digital Experience is affected by improper input sanitation6.5 Medium
- mihail-barinov advanced woo labels – product labels & badges for woocommerceAdvanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting5.4 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection7.2 High
- webkul qloappsQloApps through 1.7.0 Reflected XSS via Length of Stay Fields5.1 Medium
- webkul qloappsQloApps through 1.7.0 Reflected XSS via Room Type Editor5.1 Medium
- webkul qloappsQloApps through 1.7.0 Reflected XSS via exceptions field5.1 Medium
- webkul qloappsQloApps through 1.7.0 Reflected XSS via Book Now Search Parameters5.1 Medium
- aja video systems helo plusAJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter5.3 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Stored Cross-site Scripting (XSS)8.1 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core stored XSS8.7 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)9.3 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core stored XSS8.7 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpmu dev brandaWordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability7.1 High
- boldgrid post and page builder by boldgridWordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- sayontan photonic gallery & lightbox for flickr, smugmug & othersWordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme curcyWordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- cure53 dompurifyDOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks5.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was...6.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was...4.7 Medium
- mispMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph6.2 Medium
- mispMISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field6.2 Medium
- jeff starr user submitted postsWordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- supreme modules liteWordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aman cf7 views – complete entry management for contact form 7WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- cool plugins formkit liteWordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kingaddons king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yith woocommerce tab manager, yithemes yith woocommerce tab manager +1 moreWordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jayson t cote oauth serverWordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…