CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wpmanageninja best payments plugin for wpWordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability7.1 High
- hippooo hippoo mobile app for woocommerceWordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- reichertbrothers simplyrets real estate idx, simplyrets real estate idx +1 moreWordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- drupal coreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0166.5 Medium
- drupal coreDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-0156.5 Medium
- drupal gin admin themeGin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2196.5 Medium
- discourseDiscourse: Stored oEmbed HTML injection via allowed iframe7.7 High
- progress moveit transferMOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages8.0 High
- giteaGitea Jupyter notebook UI redress through CSS class injection3.5 Low
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter2.1 Low
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php5.1 Medium
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php5.1 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetproducttablesWordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- axew3 wp w3all phpbbWordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force surecartWordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- jtl-software gmbh jtl-shopStored XSS Vulnerability in JTL-Shop8.6 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability7.1 High
- jordy meow gallery custom linksGallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body4.9 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title6.4 Medium
- kitae-park mang boardMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter7.2 High
- davidevalerio record of consent extension for complianzRecord of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter7.2 High
- tigroumeow meow lightboxMeow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name6.4 Medium
- kitae-park mang boardMang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter6.4 Medium
- peprodev branches map (mapify)PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title6.4 Medium
- rhewlif donation thermometerDonation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode6.8 Medium
- made i.t. formsForms < 3.0.2 - Unauthenticated Stored XSS via Form Submission8.8 High
- supsystic pricing tablePricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link6.8 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter6.8 Medium
- roland murg wp booking systemWP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header8.8 High
- jegstudio gutenverse formGutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon6.8 Medium
- publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categoriesPublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes6.8 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update6.8 Medium
- joao romao social share buttons & analytics plugin – getsocial.ioSocial Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX6.4 Medium
- ice00 newstatpressNewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String7.2 High
- ice00 newstatpressNewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)7.2 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute7.2 High
- doctorwp contact form db for enfoldContact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values7.2 High
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field6.4 Medium
- edgarrojas smart forms – when you need more than just a contact formSmart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter7.2 High
- dougwollison po/mo editorPO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter6.4 Medium
- avisverifies verified reviews (avis vérifiés)Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)7.2 High
- adastracrypto cryptocurrency donation box – bitcoin & crypto donationsCryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter7.2 High
- dan rossiter document galleryDocument Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- wpdevart countdown timer – widget countdownCountdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute6.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter4.7 Medium
- foliovision fv player 8FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute6.4 Medium
- alexander anycommentAnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter7.2 High
- masaakitanaka booking packageBooking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- Show moreLoading…