CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name6.8 Medium
- unknown pixelyoursite, pixelyoursite pro +1 morePixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie7.2 High
- wordpress foundation wordpressWordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit4.9 Medium
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting...4.7 Medium
- No product listedA reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to...6.1 Medium
- No product listedAn issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via...9.6 Critical
- splunk soarStored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR5.7 Medium
- vaadin @vaadin/charts, vaadin, vaadin vaadin-charts-flow +1 more +3 moreMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts8.4 High
- drupal data fieldData field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-2503.5 Low
- @clerk nuxtNuxt server islands render `useHeadSafe` input without sanitisation5.4 Medium
- bootstrapBootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2367.1 High
- drupal uswds paragraph componentsUSWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-2346.5 Medium
- drupal block attributesBlock Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-2325.9 Medium
- drupal ui iconsUI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2306.5 Medium
- drupal sector distributionSector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2296.5 Medium
- drupal swiper formatterSwiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2286.5 Medium
- drupal csv fieldCSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-2266.5 Medium
- drupal abcABC - Critical - Cross-site scripting - SA-CONTRIB-2026-2247.1 High
- @clerk nuxtNuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled2.3 Low
- drupal black holeBlack Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-2237.1 High
- drupal zero pointZero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-2227.1 High
- drupal ui iconsUI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-2217.1 High
- withastro astroAstro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering6.5 Medium
- withastro astroAstro: Arbitrary CSS injection in Astro View Transitions2.3 Low
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities9.3 Critical
- githubnewbie0 odf-kitodf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values6.1 Medium
- brainstorm force surecartWordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability7.1 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- themehunk customizerWordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wasiliy strecker contest galleryWordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wso2 api manager, carbon user management ui, enterprise integrator +4 more +6 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection6.1 Medium
- phpoffice phppresentationPHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions5.3 Medium
- e107inc e107e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter5.1 Medium
- geekontheroad live summary for gravity formsWordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown jane menuJane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL8.8 High
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown translate wordpress with weglot 2.0Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting7.5 High
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass6.8 Medium
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.3.5 - Author+ Stored XSS via SVG Upload6.4 Medium
- saad iqbal advanced file managerAdvanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass7.1 High
- unknown user profile builderProfile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions7.1 High
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox7.5 High
- roland murg wp booking systemWP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter7.1 High
- unknown hirezootWP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title6.8 Medium
- faboba falang multilanguage for wordpressFalang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation8.0 High
- itsourcecode online cake ordering systemitsourcecode Online Cake Ordering System 404.php cross site scripting5.3 Medium
- sveltejs kitSvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages2.3 Low
- ibm @carbon/charts, @carbon/charts-angular, @carbon/charts-react +2 more +4 moreIBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation6.1 Medium
- Show moreLoading…