CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeUse after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- javamelodyJavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter5.1 Medium
- jason newman blogroll funBlogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php5.1 Medium
- dedecmsDedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php5.1 Medium
- łukasz więcek socialfitSocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter5.1 Medium
- carles reverter k-newsK-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter5.1 Medium
- web updates kmu custom tablesCustom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php5.1 Medium
- cachethq cachetCachet has Stored XSS in Incident Component4.8 Medium
- stormshield network securityStored XSS in the VPN logs monitor6.5 Medium
- stormshield network securityStored XSS on SNS Enrollment Portal7.0 High
- stormshield network securityStored XSS on SNS Enrollment Portal7.1 High
- apostrophecms apostrophe, sanitize-html +1 moreApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs5.4 Medium
- apostrophecms apostropheApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users6.1 Medium
- apostrophecms apostrophe, sanitize-html +1 moreApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)3.7 Low
- apostrophecms apostrophe, sanitize-html +1 moreApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render5.3 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability4.6 Medium
- apostrophecms apostropheApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization5.4 Medium
- jcrodriguez-dis moodle-mod vplVPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename5.1 Medium
- apostrophecms apostropheApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix5.4 Medium
- cozythemes rootbloxWordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force surecartWordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cypht-org cyphtCypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js5.3 Medium
- ticimax informatics technologies inc. e-commerce platformXSS in Ticimax Informatics' Ticimax E-Commerce Platform6.1 Medium
- unblu inc. sparkUnblu Spark Cross-Site Scripting in Embedded Co-Browsing8.6 High
- optimal idm optimalcloudOptimal IdM OptimalCloud Login cross site scripting5.3 Medium
- chatwootChatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links4.8 Medium
- marmelab react-adminreact-admin before 5.15.5 Stored XSS via UrlField and FileField5.1 Medium
- brizyWordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- typo3 extension "typo3 fluid-form by coding.ms"Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)5.3 Medium
- facturascriptsMultiple vulnerabilities in FacturaScripts6.9 Medium
- facturascriptsMultiple vulnerabilities in FacturaScripts6.9 Medium
- stormshield network securityPossible DOM XSS in SNS Web Administration Portal6.6 Medium
- divigear carouselDiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action6.4 Medium
- ly corporation liff sdkA vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an…5.1 Medium
- grandnode grandnode2grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting4.8 Medium
- ibm cloud pak systemIBM Cloud Pak System Cross-Site Scripting6.1 Medium
- ibm cloud pak systemIBM Cloud Pak System Cross-Site Scripting7.4 High
- ibm concertIBM Concert Software Cross-Site Scripting6.1 Medium
- wuxi wubang security software five-in-one safety production management information systemWuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting5.3 Medium
- wso2 api control plane, api manager, carbon event publisher ui +3 more +5 moreStored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection4.3 Medium
- mljar mercuryMercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML6.1 Medium
- mi6 intelligence community ui kit canary web componentsMI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item2.3 Low
- koalixswitzerland koalixcrmKoalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin5.1 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- e2pdfWordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yith woocommerce wishlistWordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apache software foundation answerApache Answer: Stored XSS via unsanitized HTML in imported question content5.4 Medium
- mispMISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels4.8 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…