CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy8.4 High
- intlify vue-i18nVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages7.2 High
- intlify vue-i18nVue I18n: `escapeParameter` does not escape named values when the same call also passes a list2.1 Low
- highcharts, @highcharts dashboards, grid-pro +2 moreHighcharts Grid: javascript: URL in credits.href runs script on click8.4 High
- highcharts, @highcharts grid-lite, grid-pro +2 moreHighcharts Grid: pagination language options are parsed as HTML8.6 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: fullscreen labels are parsed as HTML8.4 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: sidebar component labels are parsed as HTML8.4 High
- highchartsHighcharts: javascript: URL in credits.href runs script on click8.4 High
- highchartsHighcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes8.4 High
- @highcharts dashboards, highcharts +1 moreHighcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace8.6 High
- drupal stage file proxyStage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-2866.5 Medium
- drupal signature pad widgetSignature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-2856.1 Medium
- highchartsHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print7.2 High
- highcharts, @highcharts grid-lite, grid-pro +2 moreHighcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`8.5 High
- highcharts, @highcharts dashboards, grid-pro +2 moreHighcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`8.5 High
- highchartsHighcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts7.2 High
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2735.5 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2726.5 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-2697.1 High
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2676.5 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-2666.5 Medium
- drupal commerce stripeCommerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-2655.1 Medium
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips...5.4 Medium
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing...6.1 Medium
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link...6.1 Medium
- gfi usa, llc kerioconnectGFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter5.1 Medium
- iova.mihai slicewpWordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp discussion board discussion boardWordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ayecode ltd getpaidWordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability7.1 High
- crowd favorite dxp toolkitWordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.8.6 High
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.128.6 High
- acronis cyber protect 17Cross-site scripting (XSS) vulnerability due to improper input validation. The following products...5.7 Medium
- fazile bacak defterasist financial advisor platformStored XSS Fazile BACAK's DefterAsist Financial Advisor Platform5.4 Medium
- echoplugins echo knowledge base – documentation, faqs, chat & smart searchEcho Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter6.1 Medium
- cozythemes cozy blocks – website builder & business growth toolkit | popups, lead forms & inboxCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute6.4 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter4.9 Medium
- bplugins document embedder – let visitors read files without downloadingDocument Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute6.4 Medium
- saadiqbal post snippets – custom wordpress code snippets customizerPost Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title6.4 Medium
- jtsternberg cmb2CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form5.4 Medium
- acowebs product addons for woocommerce – product options with custom fieldsProduct Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter4.4 Medium
- kitae-park mang boardMang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute6.4 Medium
- wpdevteam easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutioneasy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute6.4 Medium
- bdthemes prime slider – hero slider, carousel, woocommerce & post slider elementor addonsPrime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape7.2 High
- webheadllc webheadcoder multi-step forms for contact form 7Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter6.1 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute6.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes6.4 Medium
- Show moreLoading…