CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wp smart widgets better post & filter widgets for elementorWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kevin weber lazy load for videosWordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins image gallery block – create and display photo gallery/photo album.WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zuinq studio ismygymReflected Cross-Site Scripting in software IsMyGym by Zuinq Studio5.1 Medium
- regional parliament of castile-la mancha video library of the regional parliament of castile-la manchaReflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha5.1 Medium
- opnsense firewallMultiple cross-site scripting (XSS) in OPNsense5.6 Medium
- ffxiv-teamcraft ffxiv teamcraftffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting5.1 Medium
- edimax br-6208acEdimax BR-6208AC Virtual Server cross site scripting4.8 Medium
- No product listedgougucms User Level Level.php add cross site scripting4.8 Medium
- mathurvishal cloudclassroom-php-projectCloudClassroom-PHP-Project addnewstudent.php cross site scripting5.3 Medium
- yeswikiYesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax5.3 Medium
- yeswikiYesWiki before 4.7.0 Stored XSS via filtertags Action Parameters5.3 Medium
- yeswikiYesWiki before 4.7.0 Stored XSS via ImageField SVG Upload5.1 Medium
- siyuan-note siyuanSiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks5.1 Medium
- siyuan-note siyuanSiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter7.6 High
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options4.8 Medium
- wwbn avideoWWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering5.1 Medium
- privoce vocechatPrivoce Vocechat Query Parameter widget.html cross site scripting5.3 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color6.8 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.8.0 - Admin+ Stored XSS3.5 Low
- onyx-dot-app onyxonyx-dot-app Onyx PreviewTab.tsx cross site scripting5.1 Medium
- No product listedphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting5.3 Medium
- No product listedphpIPAM index.php cross site scripting4.8 Medium
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cervantessec cervantesStored XSS in the “Notes” field of project checklists6.8 Medium
- infomaniak network vod infomaniakWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- pixelite events managerWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- quarka qa analyticsWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- plugins360 all-in-one video galleryWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bold grid w3 total cacheWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wordplus bp better messagesWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- noah hearle we’re open!WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- arraytics wp event solutionWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown wpvrWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content6.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute6.8 Medium
- unknown download monitorDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link7.1 High
- unknown pixel tag manager for woocommercePixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID6.8 Medium
odf-kitnpmodf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values6.1 Medium- phpbbImproper sanitization in the registration module allows reflected Cross-Site Scripting.8.3 High
- phoca.cz phoca gallery extension for joomlaJoomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.58.6 High
- intranda goobi-viewer-coreGoobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS9.3 Critical
- gfi software archiverGFI Archiver < 15.14 Stored XSS via MailInsights.aspx5.1 Medium
- baserproject basercmsbaserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments7.1 High
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreZimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter6.1 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreZimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters5.4 Medium
- yahoo serialize-javascriptSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body2.1 Low
- Show moreLoading…