CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- openidentityplatform openamOpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page5.1 Medium
- openidentityplatform openamOpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page5.3 Medium
- unknown twenty20 image before-afterTwenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute6.4 Medium
- wpclever wpc estimated delivery date for woocommerceWPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter6.1 Medium
- syam mohan wpfront notification barWPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI6.1 Medium
- wardee mail logging & catcherMail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message7.2 High
- wpclever wpc product options for woocommerceWPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name7.2 High
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter6.1 Medium
- cyberchimps responsive starter templates – elementor templates & starter sitesResponsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- amauric wpmobile.app – android and ios app builderWPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment5.4 Medium
- timwhitlock loco translateLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration6.8 Medium
- extendthemes kubio ai page builderKubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content8.8 High
- extendthemes kubio ai page builderKubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute6.8 Medium
- unknown wp ultimate csv importerWP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload3.5 Low
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings6.4 Medium
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission7.5 High
- codepeople calculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & moreCalculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation6.1 Medium
- wpclever wpc smart quick view for woocommerceWPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter6.1 Medium
- ivijanstefan transliterator – multilingual and multi-script text conversionTransliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder7.2 High
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter4.9 Medium
- richplugins rich showcase for google reviewsRich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)6.4 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters7.2 High
- ultrapressorg ultra addons lite for elementorUltra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget6.4 Medium
- wpchill strong testimonialsStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field7.2 High
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name7.2 High
- magicplugins magic tooltips for contact form 7Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author7.2 High
- wp-buy visitor traffic real time statisticsVisitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header7.2 High
- gdragon gd rating systemGD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX7.2 High
- roxnor wp social login and register social counterWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write6.4 Medium
- wpdevteam embedpress – pdf embedder, 3d pdf flipbook, google reviews, youtube videos, upload & embed pdf documentsEmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute6.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter6.1 Medium
- devowl real cookie banner: gdpr & eprivacy cookie consentReal Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment7.2 High
- exactly www ewww image optimizerEWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key6.1 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter6.1 Medium
- psmplugins supportcandy – ai customer support ticket system & live chatbot agentSupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter6.4 Medium
- vinod-dalvi ivory search – wordpress search pluginIvory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter6.1 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter7.2 High
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment5.4 Medium
- mindstellar shopclassShopclass before 6.2.0 Stored XSS via Listing Description Field5.1 Medium
- showdownjs showdownShowdown through 2.1.0 XSS via unescaped quote in href and src attributes5.3 Medium
- idurar idurar-erp-crmIDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload5.1 Medium
- limesurveyLimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute7.2 High
- prosemirror prosemirror-viewProseMirror: XSS vulnerability in prosemirror-view's paste handling8.5 High
- mispMISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler4.8 Medium
- mispMISP TAXII Object Viewer Stored XSS via Unescaped JSON Output6.2 Medium
- mispMISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server5.1 Medium
- mispMISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index5.3 Medium
- loglama.net turkhotspotReflected XSS in MRV Technology's TurkHotspot5.2 Medium
- crocoblock jetappointmentJetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter7.2 High
- sourcecodester student result management systemSourceCodester Student Result Management System Announcement new_announcement.php cross site scripting5.3 Medium
- Show moreLoading…