CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- seopressSEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings7.1 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action6.8 Medium
- unknown form maker by 10webForm Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values7.5 High
- unknown cookieyesCookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts6.4 Medium
libsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile5.4 Mediumlibweb-simple-perlDebianWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment6.1 Mediumlibcgi-pm-perlDebian,perl-CGIopenSUSE +1 moreCGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url6.1 Mediumlibcgi-pm-perlDebian,perl-CGIAzure Linux +1 moreCGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form6.1 Medium- humhub community editionHumHub 1.19.0 - Stored cross-site scripting in friendship confirmation7.2 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of...3.3 Low
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of...6.8 Medium
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of...9.0 Critical
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of...8.8 High
- vembu technologies bdrsuiteVembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp5.1 Medium
- vembu technologies bdrsuiteVembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp5.1 Medium
- aws maplibre-gl-js-amplifyStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering4.8 Medium
- traptitech traqtraQ: XSS in the User Uploaded File Retrieval API7.3 High
- enspirit eloElo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter9.8 Critical
- jarun bukubuku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL5.3 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- barn2 plugins posts table with search & sortWordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- texlyreTeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import5.3 Medium
- amidaware tactical rmmCVE-2026-1215786.1 Medium
- postfixadminPostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description5.1 Medium
- darylldoyle svg-sanitizersvg-sanitizer before 1.1.0 XSS via animateTransform on Safari5.3 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- am system alo suiteStored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.5.1 Medium
- typo3 extension "mail"Cross-Site Scripting in extension "Mail" (mail)5.1 Medium
- naver billboard.jsbillboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper...6.1 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification6.1 Medium
- jordy meow photo engine (media organizer & lightroom)Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name6.4 Medium
- blazethemes news kit addons for elementorNews Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action6.4 Medium
- tigroumeow seo engine – smart seo with ai, schema & redirection for wordpressSEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()6.4 Medium
- welcart e-commerce pluginWelcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting5.3 Medium
- aws aidlc-traceabilityStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows4.6 Medium
- petpooja munshiMunshi XSS via Purchase Inquiry Thread Rendering5.1 Medium
- fossbillingFOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes8.4 High
- redimp otterwikiAn Otter Wiki before 2.26.2 Stored XSS via Math Code Block5.3 Medium
- wren security wrensec-commonsXSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter6.1 Medium
- Show moreLoading…