CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- cure53 dompurifyDOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root5.1 Medium
- laurent22 joplinJoplin whiteboard card rendering allows CSS injection into application chrome4.6 Medium
@vue/server-renderernpm,@rootio/vue__server-rendererRoot +1 more@vue/server-renderer: XSS via missing CR in attribute-name blacklist7.2 High- penpotPenpot: Stored XSS via Unsanitised SVG Uploads5.4 Medium
- tryghost ghostGhost: Stored XSS via SVG Uploads Bypassing Sanitization7.3 High
- tryghost ghostGhost: Stored XSS via SVG Files in Content Imports6.8 Medium
- tryghost ghostGhost: Stored XSS via Embed Card Previews7.3 High
- villatheme photo reviews for woocommerceWordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability7.1 High
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- makeplane planePlane: Stored XSS via SVG attachment served inline on the application origin (account takeover)8.7 High
- makeplane planePlane: Cross-tenant stored XSS in intake enables account takeover8.7 High
- jose fernandez adsmonetizerWordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- ghozylab image slider widgetWordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- red hat quay 3Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page4.2 Medium
- red hat quay 3Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter5.4 Medium
- ollyo sp page builder, joomshaper.com sp page builder (pro) extension for joomla +1 moreJoomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p25.3 Medium
- thimpress learnpressLearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation5.1 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting5.3 Medium
- zabbixStored XSS vulnerability in OAuth configuration form5.6 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting5.1 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting5.3 Medium
- brainstorm force starter templatesWordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeroen peters name directoryWordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force presto player, presto made, inc player +1 moreWordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themepoints logo showcaseWordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sonaar mp3 audio player for music, radio & podcast by sonaarWordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nikki blight qr redirectorWordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mitel mivoice office 400Mitel MiVoice Office 400 stored Cross-Site Scripting1.9 Low
- mitel mivoice office 400Mitel MiVoice Office 400 stored Cross-Site Scripting1.9 Low
- bplugins b blocksWordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp chill image photo gallery final tiles gridWordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- code-projects human resource management systemcode-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting5.1 Medium
- code-projects human resource managementcode-projects Human Resource Management Event Creation EventStore.php cross site scripting5.1 Medium
- No product listedIn Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.5.4 Medium
- No product listedBacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.6.1 Medium
- klembot twinejsTwine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files8.5 High
- wwbn avideoWWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title9.3 Critical
- wwbn avideoWWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates9.3 Critical
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability7.1 High
- veronalabs wp statisticsWordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs translatepressWordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- mra13 simple shopping cartSimple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials3.5 Low
- gopiplus horizontal scrolling announcementsHorizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field6.8 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting5.1 Medium
- vincent-peugnet wcmsW (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…