CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- jeroenpeters1986 name directoryName Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute6.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter6.4 Medium
- brainstormforce suredash – community, courses & member dashboardSureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter6.4 Medium
- maxfoundry social share buttonsSocial Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting6.4 Medium
- damian-gora fibosearch – ajax search for woocommerceFiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter6.4 Medium
- wpeverest user registration pro – custom registration form, login form, and user profile wordpress pluginUser Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header7.2 High
- favethemes houzezWordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- smub wpconsent – cookie banner & cookie consent for privacy compliance (gdpr / ccpa / eu compliance cookie notice)WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)7.2 High
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import5.4 Medium
- hivepress – business directory, listings & classified ads pluginHivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value7.2 High
- hivepress – business directory, listings & classified ads pluginHivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode6.4 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers7.2 High
- ajay webberzone top 10 — popular postsWebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute6.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field6.4 Medium
- codepeople cp multi view events calendarCP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter7.2 High
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes6.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field7.2 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter6.1 Medium
- wpdevteam notificationx – fomo, live sales notification, woocommerce sales popup, gdpr, social proof, announcement banner & floating notification barNotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route7.2 High
- gpriday siteorigin cssSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink7.2 High
- johndarrel hide my wp ghost – security & firewallHide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- gpriday siteorigin cssSiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector7.2 High
- wordpresschef salon booking system – appointment booking for salons, barbershops & spasSalon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX7.2 High
- optiuser opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insightsOpti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter7.2 High
- optiuser opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insightsOpti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter7.2 High
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}7.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter6.4 Medium
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload7.2 High
- themefic tourfic – ai powered travel booking, hotel booking & car rentalTourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute6.4 Medium
- fullworks quick paypal payments: payment button & formQuick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute6.4 Medium
- elvinhaci sql chart builderSQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field6.4 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter7.2 High
- mpol gwolle guestbookGwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter6.1 Medium
- kitae-park mang boardMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX7.2 High
- kitae-park mang boardMang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter6.4 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL7.2 High
- extend themes colibri page builderColibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments7.2 High
- complianz gdpr/ccpa cookie consent bannerComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter7.2 High
- gijo flying scripts: delay javascript to improve site speed & performanceFlying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- wppool dark mode – improve accessibility with ai powered dark themeWP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute6.4 Medium
- goratech cooked – recipe managementCooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content6.4 Medium
- backdropcms backdropBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate...5.3 Medium
- No product listedCross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker...5.4 Medium
- webkul aureus erpAureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal5.1 Medium
- abhinavxd libredeskLibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter5.1 Medium
- aureuserpAureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information5.1 Medium
- netgate pfsense ce, pfsense +1 moreNetgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php2.3 Low
- netgate pfsense ce, pfsense +1 moreNetgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color4.8 Medium
- red hat ansible automation platform 2Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)5.4 Medium
- htmlunit htmlunit-nekoHtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode7.2 High
- Show moreLoading…