CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- themeisle multiple pages generator by themeisleMultiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url5.1 Medium
- bplugins pdf posterWordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Knowledge Articles5.1 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins video gallery blockWordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Attachments4.8 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Work Notes5.1 Medium
- cozythemes cozy blocksWordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mamunur rashid the post gridWordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- newsman newsmanappNewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters7.2 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header7.2 High
- metabox meta box – a framework for dynamic websitesMeta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys4.9 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- pluginus.net tableonWordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- oceanwpWordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- devitemsllc ht mega addons for elementor – elementor widgets & template builderHT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink5.4 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)5.4 Medium
- mapster wp mapsMapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter7.2 High
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization6.4 Medium
- berocket sequential order numbers for woocommerceSequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys6.4 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter6.1 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText5.4 Medium
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block5.4 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element4.7 Medium
- david lingren media library assistantMedia Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links4.7 Medium
- hupe13 extensions for leaflet mapExtensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property5.4 Medium
- ict innovations innovations’ php-cgi/php-fpm configurationReflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration5.1 Medium
- jackdewey community eventsCommunity Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form8.8 High
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass6.8 Medium
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass6.8 Medium
- unknown appointment booking pluginLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings3.5 Low
- unknown letterpressLetterPress < 2.4.0 - Admin+ Stored XSS3.5 Low
- saadiqbal password protected – protect your site content with a passwordPassword Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler6.4 Medium
- vberkel schema app structured dataSchema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter7.2 High
- mlfactory dsgvo all in one for wpDSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption7.2 High
- wp scripts food store – online food delivery & pickupFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie7.2 High
- canva orttoThe Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings...4.8 Medium
- apereo foundation openequellaStored XSS in pre-login notice via reachable legacy logon route4.8 Medium
- configuroweb inventariobasicoconfiguroweb inventariobasico Add Product addlist.php cross site scripting5.1 Medium
- wwbn avideo-encoderAVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles4.7 Medium
- wwbn avideo-encoderAVideo-Encoder: reflected cross-site scripting in the login interface6.1 Medium
- labstack echoEcho: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob6.1 Medium
- fearlessgeekmedia fearlesscmsFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS9.4 Critical
- wso2 api control plane, api manager, identity server +2 moreCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products6.1 Medium
- Show moreLoading…