CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- tijmensmit wp store locator, wp store locator store locator +1 moreWordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- robosoft robo galleryWordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shortpixel image optimizerWordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- progressive robot ltd hmailserverImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer8.0 High
- sqlview krisStored Cross-Site Scripting in SQLView KRIS6.8 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes6.8 Medium
- unknown gptranslateGPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage7.5 High
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreIn Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in...6.5 Medium
- r3098 aurora heatmapAurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter6.1 Medium
- fontsplugin disable and remove google fonts | gdpr & dsgvo friendlyWordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- drupal countryCountry - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2113.1 Low
- drupal menu link attributesMenu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2093.8 Low
- drupal leafletLeaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-2045.4 Medium
- drupal mathjax: latex for drupalMathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-1955.4 Medium
- gophishGophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages2.3 Low
- sonicwall sma1000Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the...6.1 Medium
- wedevs happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes prime slider – addons for elementorWordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp media rocket lazy loadWordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- veeam backup enterprise managerThis vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the...4.8 Medium
- apache software foundation impalaApache Impala: Stored XSS in Impala query plans5.4 Medium
- daanvandenbergh omgf | gdpr/dsgvo compliant, faster google fonts. easy.OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed7.2 High
- unknown if-so dynamic contentIf-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter7.1 High
- unknown magee shortcodesMagee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions7.1 High
- unknown envira galleryEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions6.8 Medium
- unknown envira galleryEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID6.8 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata7.2 High
- asus routerImproper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS...9.3 Critical
- No product listedThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or...6.1 Medium
- No product listedThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or...6.1 Medium
- giteaGitea repository media API stored XSS6.1 Medium
- apache software foundation commons bcelApache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS2.3 Low
- arista networks cloudvision cueSecurity Advisory 01929.3 Critical
- arista networks cloudvision cueSecurity Advisory 01926.2 Medium
- arista networks cloudvision portalSecurity Advisory 01859.3 Critical
- giteaGitea container registry stored XSS through blob media type5.4 Medium
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface5.4 Medium
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface8.8 High
- netbox-community netboxNetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links6.9 Medium
- misp sachertortephpMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS8.4 High
- red hat ansible automation platform 2, hardened images +1 moreAnsible: ansible-ui: ansible ui dom xss in /redirect next parameter5.4 Medium
- @quasar app-vite, quasarframework quasar +1 moreQuasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained8.3 High
- @quasar app-vite, render-ssr-error, quasarframework quasar +2 moreQuasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable7.1 High
- quasarframework quasarQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()10.0 Critical
- Show moreLoading…