CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- themefusecom brizy – page builderBrizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta6.4 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer4.7 Medium
- eric teubert podlove podcast publisherPodlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook7.2 High
- supsysticcom data tables generator by supsysticData Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute6.4 Medium
- picocodes noptin – newsletter, new post notifications & email automationSimple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot5.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes6.4 Medium
- 2winfactor presto player, presto made, inc player +1 morePresto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag7.2 High
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute6.4 Medium
- awsmin embed any document – embed pdf, word, powerpoint and excel filesEmbed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode6.4 Medium
- andy moyle church adminChurch Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter6.4 Medium
- jetmonsters getwid – gutenberg blocksGetwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'6.4 Medium
- rameez iqbal real estate manager – property listing and agent managementReal Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter7.2 High
- hivepress – business directory, listings & classified ads pluginHivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format6.4 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- rubengc gamipress – gamification plugin to reward points, badges & ranks in wordpress, now with aiGamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter6.4 Medium
- jonua table field add-on for acf and scfTable Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content6.4 Medium
- codename065 download managerDownload Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode6.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key6.1 Medium
- cleantalk anti-spam by cleantalk – spam protection without captchaAnti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex5.4 Medium
- stepasyuk filter everything — wordpress & woocommerce filtersFilter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL6.1 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>6.4 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute6.4 Medium
- codename065 download managerDownload Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute6.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter4.7 Medium
- supsysticcom data tables generator by supsysticData Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action6.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field6.4 Medium
- jonua table field add-on for acf and scfTable Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value6.4 Medium
- pluginsware advanced classifieds & directory proAdvanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter6.4 Medium
- @tinacms web-components, tinacms +1 more@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS7.6 High
- contaoContao: Cross-site scripting in the comments bundle9.3 Critical
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- iflytek astron-rpaAstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge7.7 High
- toolbox-team reddit-moderator-toolboxModerator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration5.1 Medium
- smartertools smartermailSmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content5.3 Medium
- spabrice pondWordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themerex education centerWordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tmt machine industry and trade ltd. co. talassoft industrial management softwareStored XSS in TMT Machine's Talassoft Industrial Management Software5.4 Medium
- designthemes whistle - sports clubWordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bracketweb voldorWordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bracketweb ogencyWordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bracketweb treckWordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- delight star inc. wp associate post r2WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- acymailing newsletter team smtp newsletter, datasolution acymailing smtp newsletter +1 moreWordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpfunnelsWordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins html5 audio playerWordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bkninja gloria admin panelWordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- heateor support sassy social shareWordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability7.1 High
- extend themes kubio ai page builderWordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods grand restaurantWordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- binti76 total donationsWordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…