CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- ays pro quiz makerWordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability7.1 High
- sourcecodester inventory systemSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System Product Management products_handler.php save cross site scripting5.1 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system feedback.php cross site scripting5.3 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting5.3 Medium
- dan rossiter document galleryDocument Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes6.8 Medium
- blazethemes blaze demo importerBlaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload6.8 Medium
- diem-project diemdiem-project diem dmWidget dmBaseLinkTag.php text cross site scripting5.1 Medium
- diem-project diemdiem-project diem Administrative Console actions.class.php append cross site scripting4.8 Medium
- diem-project diemdiem-project diem Version Check Service dmAdminCtrl.js html cross site scripting4.8 Medium
- No product listedCross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service ...6.1 Medium
- chamilo lmsChamilo LMS Ticket TicketManager.php addProject cross site scripting5.1 Medium
- bootstrap shortcodes project shortcodes, unknown bootstrap shortcodes +1 moreThe Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id...5.1 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting5.3 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability7.1 High
- ideabox creations powerpack lite for beaver builderWordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegrill estoreWordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- hrisikeshpal blood bank management systemhrisikeshpal Blood_Bank_Management_System abs.php cross site scripting5.3 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter7.1 High
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'6.8 Medium
- dext34-morgan books4cashdext34-morgan Books4Cash search.php cross site scripting5.3 Medium
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass5.1 Medium
- thorsten phpmyfaqphpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI5.1 Medium
- paycomet for woocommerceWordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability7.1 High
- wssoffice21 ymc filterYMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter6.4 Medium
- davidanderson european vat compliance assistant for woocommerceEuropean VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header7.2 High
- stiofansisland payment forms, buy now buttons, and invoicing system | getpaidPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter7.2 High
- heateor support fancy comments wordpressWordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability7.1 High
- themifyme themify popupThemify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter6.4 Medium
- daigo75 eu vat assistant for woocommerceEU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter7.2 High
- themifyme themify builderThemify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute6.4 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value7.2 High
- wpdevteam xspeed cache: ai-powered performance hub with mcp, caching & cdnxSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter6.4 Medium
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter6.1 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters7.2 High
- amauric tarteaucitron.jstarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch5.1 Medium
- countly countly-servercountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context9.0 Critical
- arcadia technology, llc crafty controllerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller5.4 Medium
- themefic tourfic – ai powered travel booking, hotel booking & car rentalTourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role6.4 Medium
- ideabox creations powerpack addons for elementorWordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pt norther lights production mapsvgWordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- activity-log.com wp sessions time monitoring full automaticWP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter7.2 High
- liedekef events made easyEvents Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter5.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute6.4 Medium
- softaculous gosmtp proGoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body7.2 High
- surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsSureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment7.2 High
- Show moreLoading…