CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- basix nex-formsWordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetreviewsWordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mamunur rashid classified listingWordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- stiofan userswpWordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability7.1 High
- stiofan blockstrap page builder - bootstrap blocksWordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability7.1 High
- muffingroup bethemeWordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- upsolution coreWordPress UpSolution Core plugin < 9.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability7.1 High
- codepeople search in placeWordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- mamunur rashid shopbuilder – elementor woocommerce builder addonsWordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- pluginus.net huskyWordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- damian góra fibosearchWordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- beetienda ecommerce platformReflected Cross-Site Scripting in BeeTienda eCommerce platform5.1 Medium
- progress software telerik report serverStored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers8.9 High
- oceanwp ocean ecomm treasure box, ocean pro demos +1 moreOcean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter7.2 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass5.5 Medium
- No product listedCloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding...5.9 Medium
- go standard library html/templateRecognize yield as regexp preceder keyword in html/template6.1 Medium
- go standard library html/templateReset context tracking on consecutive template expressions in html/template6.1 Medium
- banq jivejdonJivejdon through 5.0 Stored XSS via Attachment Upload Content-Type5.1 Medium
- banq jivejdonJivejdon through 5.0 Stored XSS via Private Short Messages5.1 Medium
- banq jivejdonJivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering5.1 Medium
- banq jivejdonJivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter5.1 Medium
- banq jivejdonJivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters5.3 Medium
- banq jivejdonJivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters5.3 Medium
- satel netco designSatel Netco Design Cross-site Scripting8.5 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access8.2 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access4.9 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.4 Medium
- indicoIndico: Cross-Site-Scripting in minutes editor4.4 Medium
- freescout-help-desk freescoutFreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header6.1 Medium
- ibm guardium data protectionIBM Guardium Data Protection Cross-Site Scripting9.3 Critical
- kodezen llc ablocksWordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- darylldoyle svg-sanitizerenshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision5.4 Medium
- jhipster generator-jhipster, react-jhipster +1 moreJHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob7.6 High
- obsidian desktopObsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass8.4 High
- obsidian desktopObsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown8.5 High
- espocrmEspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form5.3 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Cross-Site Scripting5.4 Medium
- ibm datapower gateway 10.6.0IBM DataPower Gateway affected by cross-site scripting9.3 Critical
- katie seaborn zotpressWordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brikou wp plugin info cardWordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…