CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- wing ftp server ftp serverWing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page5.1 Medium
- laradashboardLaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content5.1 Medium
- sea-team gofoundGoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results5.1 Medium
- chaitin pandawikiPandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass5.1 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.8.6 High
- php-web-design.com stageit extension for joomlaJoomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.55.3 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.8.6 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input...6.8 Medium
- wso2 api manager, carbon api manager publisher rest api +1 moreStored Cross-Site Scripting in Multiple WSO2 Products4.8 Medium
- wso2 api manager, carbon user management ui, enterprise integrator +1 more +3 moreReflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products4.6 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting5.3 Medium
- apache software foundation wicketApache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup7.6 High
- apache software foundation wicketApache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup7.6 High
- apache software foundation wicketApache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag7.4 High
- apache software foundation wicketApache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data7.4 High
- apache software foundation wicketApache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name7.6 High
- ruijie rg-es205gc, rg-es206gc-p, rg-es208gc +2 more +4 moreRuijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting4.8 Medium
- nickboss wordpress file uploadWordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- giteaGitea stored XSS through legacy Actions artifact Content-Encoding5.4 Medium
- typemillTypemill SvgSanitizer.php saveImage cross site scripting5.1 Medium
- david lingren media library assistantMedia Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute6.8 Medium
- thelia, thelia back-office default twig template, core +2 moreThelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads4.6 Medium
- No product listedPostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting5.1 Medium
- thelia, thelia core +1 moreThelia before 3.1.0 Stored XSS via Coupon Condition Customer Name7.4 High
- No product listedWebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting6.1 Medium
- themehigh woocommerce extra product options proWooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter6.1 Medium
- qriouslad debug log manager – conveniently monitor and inspect errorsDebug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint7.2 High
- wppool flexstock – product stock sync with google sheets for woocommerceFlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint6.4 Medium
- boss media buddyboss platformBuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name6.4 Medium
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter6.1 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection6.4 Medium
- radgeek feedwordpressFeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content7.2 High
- melapress wp activity logWP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- shapedplugin smart post – post grid, post carousel, post slider gutenberg blocks for blog & newsSmart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block6.4 Medium
- pluginever content pilot – autoblogging & affiliate marketing suiteContent Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`5.4 Medium
- wpo365 | microsoft 365 graph mailerWPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail7.2 High
- wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionUser Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter6.1 Medium
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag6.4 Medium
- paultgoodchild shield security – smart bot blocking, brute-force login protection & file scanningShield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log7.2 High
- publishpress co-authors, multiple authors and guest authors in an author box with publishpress authorsCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author…6.4 Medium
- arosoft shipping zones by drawing for woocommerceShipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter7.2 High
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter7.2 High
- nanbu welcart e-commerceWelcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter7.2 High
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter6.1 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter7.2 High
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout7.2 High
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting7.2 High
- marketingfire discussion board – wordpress forum pluginDiscussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field6.4 Medium
- supercleanse thirstyaffiliates – affiliate links, link branding, link tracking & marketing pluginThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag7.2 High
- Show moreLoading…