CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- themerex addonsWordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yeswikiYesWiki before 4.6.7 Stored XSS via Bazar valeur Action5.1 Medium
- yeswikiYesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter5.3 Medium
- yeswikiYesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute5.1 Medium
- yeswikiYesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler5.1 Medium
- yeswikiYesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField5.1 Medium
- yeswikiYesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action8.2 High
- tryghost ghostGhost: Stored XSS via oEmbed Photo Responses8.1 High
- tryghost ghostGhost: Stored XSS via Bookmark Card Images7.3 High
- tryghost ghostGhost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses8.6 High
- tryghost ghostGhost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images8.5 High
- tryghost ghostGhost: Stored XSS via File Uploads on Local Storage7.3 High
- tryghost ghostGhost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads8.5 High
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key6.1 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights)All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname6.1 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- repasat applicationMultiple vulnerabilities in the Repasat application4.8 Medium
- codename065 download managerDownload Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name6.4 Medium
- webilia listdom: ai-powered business directory with classifieds ads listingsListdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter6.4 Medium
- mihdan no external linksNo External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect7.2 High
- smub smash balloon social post feed – simple social feeds for wordpressSmash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action7.2 High
- kitae-park mang boardMang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter7.2 High
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)7.2 High
- relevanssi premium, unknown relevanssi premium +1 moreRelevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter7.2 High
- satollo newsletter – send awesome emails from wordpressNewsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter7.2 High
- comesio relevanssi – a better searchRelevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- wp chill download monitorDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor7.2 High
- jtsternberg cmb2CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type7.2 High
- apasionados dofollow case by caseDoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- jtsternberg cmb2CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field7.2 High
- creative-solutions-1 gspeech tts – wordpress text to speech pluginGSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- websoudan mw wp formMW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)7.2 High
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder6.1 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name7.2 High
- Show moreLoading…