CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability7.1 High
- radiustheme food menu – restaurant menu & online ordering for woocommerceWordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- foliovision fv player 8WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- inisev social share icons & social share buttons, social share pro share icons & social share buttons +1 moreWordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- tielabs jannahWordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- qode real estateWordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- qode musicWordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- jotform – ai chatbotWordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- anton bond additional order filters for woocommerceWordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability7.1 High
- joomunited wp file downloadWordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- drfuri martfury - woocommerce marketplace wordpress themeWordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themestek extras for labtechco themeWordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- greg winiarski wpadvertsWordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- greg winiarski wpadvertsWordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- hivepress – business directory, listings & classified ads pluginHivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form7.2 High
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute6.4 Medium
- bracketweb zeinetWordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themefusion avada | website builder for wordpress & woocommerceAvada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field6.4 Medium
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter6.4 Medium
- brainstormforce suredash – community, courses & member dashboardSureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content6.4 Medium
- retainful email marketing for wordpress and woocommerce – retainfulEmail Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint6.4 Medium
- wpo365 | seamless wordpress + microsoft integration (wpo365 | login)WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)7.2 High
- greg winiarski wpadverts – classifieds pluginWPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter7.2 High
- smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & moreWPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute4.7 Medium
- molongui authorship – author boxes, guest authors & co-authors for wordpressMolongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute7.2 High
- amans2k funnelkit – funnel builder for woocommerce checkoutFunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)7.2 High
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter6.4 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History7.2 High
- aguidrevitch wp meteor website speed optimization addonWP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name7.2 High
- wpinsider-1 simple membershipSimple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field6.4 Medium
- 10web booster – website speed optimization, cache & page speed optimizer10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name7.2 High
- techlabpro1 team – team members showcase pluginTeam <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode6.4 Medium
- wp media lazyload plugin – lazy load images, videos, and iframesLazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content6.4 Medium
- archetyped favicon rotatorFavicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix6.1 Medium
- villatheme photo reviews for woocommercePhoto Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter7.2 High
- paymentplugins payment plugins for stripe woocommercePayment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment6.1 Medium
- dfactory responsive lightbox & galleryResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute4.4 Medium
- wpxpo post grid gutenberg blocks – postxPost Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field7.2 High
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionUser Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter6.4 Medium
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter7.2 High
- expresstech quiz and survey master (qsm) – quiz maker & survey makerQuiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter7.2 High
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules8.8 High
- unknown gallery photoblocksGallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS6.8 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL3.5 Low
- silverks grapheneGraphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields6.4 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters7.2 High
- codename065 download managerDownload Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter6.1 Medium
- Show moreLoading…