CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter6.4 Medium
- wayne allen postiePostie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink5.4 Medium
- xootix waitlist woocommerce ( back in stock notifier )Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute6.4 Medium
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute6.4 Medium
- cozythemes cozy blocks – website builder & business growth toolkit | popups, lead forms & inboxCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute6.4 Medium
- justin nealey designsetgoDesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute4.4 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute6.4 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes6.4 Medium
- posimyththemes uichemy – convert figma, prompts and ai builds to elementor, gutenberg and bricksUiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL6.4 Medium
- mxchat – ai chatbot & content generation for wordpressMxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating7.2 High
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute6.4 Medium
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion6.4 Medium
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute6.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute6.8 Medium
- unknown mp3 audio playerMP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute6.8 Medium
- unknown افزونه پیامک ووکامرس | persian woocommerce smsPersian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter7.1 High
- unknown copy anything to clipboard for wordpressCopy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute6.8 Medium
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class6.8 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting6.8 Medium
- unknown menu cart for woocommerceWooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute7.5 High
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter6.4 Medium
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter7.2 High
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC6.4 Medium
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute7.2 High
- nalam-1 ai marketing expert — ai email marketing, ai content generator, seo analyzer, ai workflow automation, social media & ai chatbotAI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter7.2 High
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field6.4 Medium
- linksys wag200gLinksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter4.8 Medium
- w3c websubWebSub: Reflected script execution through intent-verification challenges5.7 Medium
- jeromedevome grrGRR has a Reflected XSS issue8.1 High
- golang.org/x/net golang.org/x/net/htmlCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/net6.1 Medium
- ckeditor ckeditor5CKEditor: Cross-site scripting (XSS) in the engine package8.1 High
- ckeditor ckeditor5CKEditor: Cross-site scripting (XSS) in the engine package3.1 Low
- chatgptnextweb nextchatCVE-2026-1181326.1 Medium
- adobe campaign classicAdobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization8.5 High
- gfi usa, llc kerioconnectGFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment6.2 Medium
- autodesk fusionElectronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
- autodesk fusionFusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
- autodesk fusionDesign Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
litellmPyPILiteLLM vulnerable to reflected XSS in /sso/debug/callback6.8 Medium- kgs software tia viewerStored XSS in KGS Software tia Viewer5.1 Medium
- devolutions powershell universalImproper neutralization of input during web page generation ('Cross-site Scripting') in the...8.7 High
- kulga software and telecommunications limited company news softwareReflected XSS in Kulga Software's Kulga News Software6.1 Medium
- wplakeorg advanced views – display framework – gutenberg/elementor/shortcodeAdvanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- dj-extensions.com dj-helpfularticles extension for joomlaJoomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.08.7 High
- darylldoyle svg-sanitizerdarylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass5.1 Medium
- opnsense coreREDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool5.1 Medium
- opnsense coreREDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads2.1 Low
- opnsense coreREDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets5.1 Medium
- Show moreLoading…