CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter6.4 Medium
- comesio relevanssi – a better searchRelevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode7.2 High
- boldgrid w3 total cacheW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder5.4 Medium
- surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsSureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments7.2 High
- pfefferle webmentionWebmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag6.1 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry7.2 High
- firelightwp firelight lightboxFirelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute6.8 Medium
- buildwps ppwp – password protect pagesPPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision7.2 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization7.2 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML5.4 Medium
- tigroumeow meow lightboxMeow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization7.2 High
adminneo-org/adminneoPackagistAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)8.2 High- unknown pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields7.5 High
- shopperdotcom shopperShopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation8.7 High
- phoenixframework phoenix htmlPhoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/15.3 Medium
- wit synapps runtimeWIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter5.1 Medium
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- multivendorxWordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ad inserter inserter, spacetime ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- saad iqbal all in one loginWordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- alignak fast velocity minifyWordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- bookingalgorithms ba book everythingWordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability7.1 High
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpeverest user registrationWordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brainstorm force ultimate addons for elementor - liteWordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- its-a-feature mythicMythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview7.4 High
- axigen mail serverAxigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name5.3 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter6.4 Medium
- themifyme themify builderThemify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field6.4 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments5.4 Medium
- wpdevteam easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutioneasy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter7.2 High
- independent analytics proIndependent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter7.2 High
- davidanderson redux frameworkRedux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id6.4 Medium
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body7.2 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- jordy meow meow galleryMeow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)6.4 Medium
- likebtn like button rating ♥ likebtnLike Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header4.7 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute5.4 Medium
- codepeople cp multi view events calendarCP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter6.4 Medium
- mytinywmsmyTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management8.1 High
- frappe lmsFrappe LMS has Stored XSS in Course Meta5.1 Medium
- bplugins media player addons for elementor – media player widget for wpWordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- best practical solutions request trackerStored XSS via crafted URLs in HTML ticket content in Request Tracker5.3 Medium
- best practical solutions rt for incident responseStored XSS via related ticket subject on RTIR Split and Create Incident forms5.3 Medium
- best practical solutions rt for incident responseStored XSS via HTML scrubber rule in RTIR5.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…