CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- collaboraonline onlineCollabora Online: Reflected HTML injection through host_session_id4.7 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- creative themes blocksy companionWordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chamilo chamilo-lmsChamilo LMS: Stored XSS in public user-profile fields8.9 High
- netsweeperNetsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php5.1 Medium
- socfortress copilotSOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover9.9 Critical
- manageengine sharepoint manager plusStored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature8.5 High
- arketeam bdf, protectelmaj +1 moreStored XSS in Protectel5.1 Medium
- phpmyadminphpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name5.1 Medium
- google cloud identity platform and firebase authenticationCross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID8.7 High
- gravity forms formsGravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field7.2 High
- wp scripts food store – online food delivery & pickupFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie7.2 High
- gravity forms formsGravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values7.2 High
- firelightwp firelight lightboxFirelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute6.8 Medium
- unknown joinchatJoinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute6.8 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters8.8 High
- unknown user frontendWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter4.7 Medium
- liedekef events made easyEvents Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- coolplugins cool formkit lite – advanced form builder for elementorCool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter6.4 Medium
- No product listedCross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote...6.1 Medium
- No product listedAn authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component...5.4 Medium
- labredescefetrj wegiaWeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field8.9 High
- labredescefetrj wegiaWeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover6.3 Medium
- bob chained quizWordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- emarket-design youtube showcaseWordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- blockonomicsWordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- merv barrett easy property listingsWordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability7.1 High
- joe hawes auction nudge – your ebay on your siteWordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- razorpay payment button elementor pluginWordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- podamibe nepal custom user gravatarWordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nicashmu post video playersWordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- imithemes eventerWordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- global payments globalpayments woocommerceWordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- synacor zimbra collaborationStored Cross-Site Scripting in Zimbra5.3 Medium
- synacor zimbra collaborationStored Cross-Site Scripting in Zimbra5.3 Medium
- posimyth the plus addons for elementor page builder liteWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins flash & html5 videoWordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wedevs happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins streamcastWordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- publishpress authorsWordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc helix operations managementReflected Cross-Site Scripting in BMC Helix Operations Management4.8 Medium
- bmc it service management suiteReflected Cross-Site Scripting in BMC ITSM SmartIT4.8 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…