CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- mayerbalintdev gym-oneGYM One admin user list is vulnerable to stored cross-site scripting8.7 High
- brainstorm force presto player, presto made, inc player +1 moreWordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp chill download monitorWordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yith woocommerce compareWordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pluginus.net mdtfWordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- heliumedu platformHelium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts3.5 Low
- 8theme xstoreWordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- lycheeorg lycheeLychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)5.7 Medium
- sonatype nexus repository 3Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI5.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log...6.7 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project...8.0 High
- opnsense coreOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views8.0 High
- opnsense coreOPNsense: Stored XSS in Administration Settings via Certificate Description5.2 Medium
- opnsense coreOPNsense: Stored XSS in Services: NTP GPS5.4 Medium
- opnsense coreOPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout5.4 Medium
- espocrmEspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received4.3 Medium
- espocrmEspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled3.5 Low
- espocrmEspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user2.7 Low
- progress kendo ui, progress software kendo ui for jquery +1 moreCross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar5.4 Medium
- progress software kendo ui for jqueryCross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip5.4 Medium
- maxfoundry social share buttonsWordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability7.1 High
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bannersky bsk pdf managerWordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- qnap systems inc. quftp servicePrivilege Escalation via QuFTP Log-based XSS6.3 Medium
- qnap systems inc. notes station 3Stored Cross-Site Scripting (XSS) in Note Station file upload functionality4.8 Medium
- qnap systems inc. network & virtual switchStored XSS via Interface Name in Network & Virtual Switch App6.2 Medium
- dan rossiter document galleryDocument Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute7.1 High
- vektor-inc vk blocksVK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature6.4 Medium
- data443 tracking code managerTracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'6.1 Medium
- kitae-park mang boardMang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter7.2 High
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter6.1 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter7.2 High
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'7.2 High
- boldgrid post and page builder by boldgrid – visual drag and drop editorPost and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute6.4 Medium
- carazo import and export users and customersImport and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields6.4 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content6.4 Medium
- No product listedXXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job...5.4 Medium
- No product listedXXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE...5.4 Medium
- No product listedELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component...6.1 Medium
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview7.2 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter7.0 High
- error311 fileriseFileRise: Unsanitized footerHtml in Public Site Config4.8 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability1.1 Low
- shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview6.9 Medium
- dataeaseDataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting5.1 Medium
- dataeaseDataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting5.1 Medium
- lichess-org lilalichess.org: Stored HTML Injection via PGN Annotator Tag in Studies5.4 Medium
- Show moreLoading…