CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- smub wp mail loggingWP Mail Logging < 1.17.0 - Unauthenticated HTML Injection4.3 Medium
- bookingalgorithms ba book everythingBA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter7.2 High
- webpros cpanel, wp squared +1 moreThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts...9.0 Critical
- webpros cpanel, wp squared +1 moreThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify...9.0 Critical
- stylemixthemes motorsMotors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color6.8 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter6.8 Medium
- unknown tabs responsiveTabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content6.8 Medium
- optimizingmatters autoptimizeAutoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name5.4 Medium
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission7.2 High
- themefusion avada | website builder for wordpress & woocommerceAvada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter6.1 Medium
- codepress it solutions llc visitor traffic real time statistics proVisitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)7.2 High
- cwe-79 - cross-site scripting capec-63Improper neutralization of input during web page generation ('cross-site scripting')...5.8 Medium
- getsimplecms-ceGetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php8.7 High
- getsimplecms-ceGetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content8.8 High
- givanz vvvebVvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character8.7 High
- codexonics prime moverPrime Mover < 2.2.1 Stored XSS via Package Metadata5.1 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.7.2 High
- bplugins parallax section blockWordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- premmerce wishlist for woocommerceWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- premmerce wishlist for woocommerceWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- maxfoundry maxgalleriaWordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- rhukster dom-sanitizerrhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting5.1 Medium
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpmet metformWordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- roxnor elementskit elementor addons liteWordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- roxnor elementskit elementor addons liteWordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shahjahan jewel fluentformWordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tryghost ghostGhost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head8.6 High
- tryghost ghostGhost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed8.6 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator6.9 Medium
- crocantickets entradiumMultiple vulnerabilities in Entradium by Crocantickets4.8 Medium
- crocantickets entradiumMultiple vulnerabilities in Entradium by Crocantickets4.8 Medium
- crocantickets entradiumMultiple vulnerabilities in Entradium by Crocantickets4.8 Medium
- crocantickets entradiumMultiple vulnerabilities in Entradium by Crocantickets4.8 Medium
- pandora fms fmsStored Cross-Site Scripting via Directory Name in File Manager Create Directory8.4 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter7.2 High
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsGutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute6.4 Medium
- pandora fms fmsCSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager7.4 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible8.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was...2.0 Low
- mispMISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter4.8 Medium
- mispMISP Reflected XSS in Taxonomy Tag Confirmation Forms5.1 Medium
- scottpaterson business essentials for contact form 7Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field7.2 High
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter6.1 Medium
- copydeleteposts duplicate postDuplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter6.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields7.2 High
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action6.4 Medium
- codepeople calculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & moreCalculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value4.7 Medium
- robin wilson bbp style packbbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name6.4 Medium
- codepeople appointment hour booking – booking calendarAppointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer7.2 High
- Show moreLoading…