CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- adobe commerce, commerce b2b, magento open source +1 more +3 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7 High
- shopwareCVE-2026-1049378.1 High
- mlogclub bbs-gobbs-go through 4.4.6 Stored XSS via Image Upload Content-Type5.1 Medium
- benjaminjonard koillectionKoillection through 1.8.4 Stored XSS via Datum File Attachment Uploads5.1 Medium
- unstructured-io unstructuredunstructured: Stored XSS via unescaped HTML generation6.1 Medium
- jhuckaby cronicleCronicle: Stored XSS in admin Activity Log via account full_name field9.0 Critical
- @tanstack react-start, solid-start, start-server-core +2 more +4 moreTanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses9.3 Critical
- makeplane planePlane: XSS in work item comments8.5 High
- ibm mcp-context-forgeMCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI5.1 Medium
- froxlorFroxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value8.7 High
- siemens industrial edge app publisherA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)....7.7 High
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal data contained in imported calculated...5.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal names contained in imported CSV trace...5.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize signal names contained in imported CSV trace files...5.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly validate and sanitize visual marker data contained in imported...9.4 Critical
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize comment fields contained in imported trace files before...9.4 Critical
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal data contained in imported CSV trace...5.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly validate and sanitize visual properties of calculated signals...5.3 Medium
- hossni mubarak books galleryWordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force surecartWordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- youmind web applicationCross-Site Scripting in the YouMind web application5.1 Medium
- bdthemes prime slider – addons for elementorWordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ideabox creations powerpack addons for elementorWordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter7.2 High
- bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationBit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback7.2 High
- hclsoftware connectionsHCL Connections is vulnerable to cross-site scripting (XSS)5.4 Medium
- mozilla firefox for iosUniversal XSS via the HTML language attribute in Translation Services8.8 High
- trustindex.io wp testimonialsWP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode6.8 Medium
- griden responsive sliderWordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- foliovision fv simpler seoWordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- idx broker impress for idx brokerWordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- unknown weaver xtreme theme supportWordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- sap se netweaver enterprise portalCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal6.1 Medium
- sap se netweaver application server abap (applications based on sap gui for html)Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)5.4 Medium
- sap se sapui5 (support assistant overlay)Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)6.1 Medium
- sap se manufacturing integration and intelligenceCross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence6.5 Medium
- philz1337x clarity-upscalerphilz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting5.1 Medium
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, microsoft.aspnetcore.components.webassembly.server +2 moreASP.NET Core Remote Code Execution Vulnerability8.8 High
- mozilla firefox, thunderbird +1 moreOther issue in the DOM: File component8.1 High
- No product listedblob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability....5.4 Medium
- No product listedProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting ...6.1 Medium
- No product listedProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting ...6.1 Medium
- ibm iIBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI8.3 High
- ibm planning analyticsIBM Planning Analytics Local is affected by security vulnerabilities6.4 Medium
- ibm planning analyticsIBM Planning Analytics Local is affected by security vulnerabilities5.4 Medium
- Show moreLoading…