CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- yahoo serialize-javascriptserialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body2.3 Low
- zimbra collaboration suiteZimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter8.7 High
- aivahthemes hostme v2WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- hogash kallyasWordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- conda-forge conda-forge.github.ioconda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard4.6 Medium
- cgm clininetReflected Cross-Site Scripting (XSS) in CGM CLININET5.1 Medium
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- vertigis ltd. webordersystem (auftragsmanager)Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem5.1 Medium
- vertigis ltd. webordersystem (kundenmanager)Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem5.1 Medium
- vertigis ltd. webordersystem (kundenmanager)Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem4.8 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes6.8 Medium
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization7.5 High
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting7.5 High
- unknown user profile builderProfile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute6.8 Medium
- siteground speed optimizerSpeed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists3.5 Low
- unknown otter blocksOtter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter7.5 High
- unknown otter blocksOtter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes6.8 Medium
- cleantalk anti-spam – complete spam protectionAnti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter7.2 High
- part-db part-db-serverPart-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer5.4 Medium
- part-db part-db-serverPart-DB: Stored HTML injection in BOM validation results via unescaped Part name5.7 Medium
- part-db part-db-serverPart-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)6.0 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting5.3 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Settings sistem.php simpan cross site scripting4.8 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting5.3 Medium
- go-vikunja vikunjaVikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header5.1 Medium
- lepture mistuneMistune before 3.3.0 Stored XSS via Include Directive HTML Files5.3 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface5.5 Medium
- agent zero zeroAgent Zero Web UI XSS8.6 High
- opencatsOpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel6.3 Medium
- cure53 dompurifyDOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content5.1 Medium
- cure53 dompurifyDOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode5.1 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system patdocmsg.php cross site scripting5.1 Medium
- retoolRetool < 3.88.0 XSS via /api/imageProxy SVG Proxying5.1 Medium
- onthegosystems wpml multilingual cms, wpml multilingual cms +1 moreWPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang5.1 Medium
- midgetspy sickbeardSickbeard build-507 Reflected XSS via testNaming pattern Parameter5.1 Medium
- discourseDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed5.1 Medium
- qcubedQCubed 3.1.1 Reflected XSS via installer step_2.php5.1 Medium
- acf extended extendedWordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- hupe13 extensions for leaflet mapWordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nicdark nd shortcodes for visual composerWordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- xootix waitlist woocommerce ( back in stock notifier )WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gloriafood restaurant menu – food ordering system – table reservationWordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brandtoss wp mailster, wp mailster mailster +1 moreWordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- jory hogeveen off-canvas sidebars & menus (slidebars)WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability7.1 High
- h5pWordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpvibes elementor addon elementsWordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- roselldk webp expressWebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser7.5 High
- unknown link libraryLink Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter6.8 Medium
- Show moreLoading…