CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- open-emr openemrOpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute8.1 High
- opentext directory services (otds)Improper neutralization of input during web page generation ('cross-site scripting')...6.3 Medium
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.08.6 High
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.08.6 High
- tassos.gr advanced custom fields extension for joomla, smile pack extension for joomla +1 moreJoomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.67.5 High
- sysadminsmedia homeboxHomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields5.4 Medium
- heyformHeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS7.6 High
- huginnHuginn before 2026.11.05 Stored XSS via OAuth Service Display Name5.1 Medium
- apache ofbizApache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session6.1 Medium
- apache software foundation sling engineApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths5.4 Medium
- apache software foundation juneauApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome10.0 Critical
- shirasagi project shirasagiA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated...5.1 Medium
- unknown wp pagenavi styleWP PageNavi Style <= 1.4 - Stored XSS via CSRF7.1 High
- unknown easy social iconsEasy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload6.8 Medium
- unknown cloud blocksCloud Blocks <= 1.1.8 - Unauthenticated Stored XSS8.8 High
- exactly www ewww image optimizerEWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute6.4 Medium
- unknown easy social iconsEasy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings3.5 Low
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption6.8 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile6.4 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key6.4 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute6.4 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System Category Management add_category.php cross site scripting4.8 Medium
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Stored XSS via SVG File Upload5.1 Medium
- benjamine jsondiffpatchjsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters2.3 Low
- vtenextvtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList5.1 Medium
- sonatype nexus repository 3Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab6.3 Medium
- zammadZammad: Stored XSS in ticket article rendering in the new Vue-based interface5.1 Medium
- empiresoft empirecmsEmpireSoft EmpireCMS index.php cross site scripting5.1 Medium
- infiniflow ragflowInfiniFlow RAGFlow Images API file_utils.py cross site scripting5.1 Medium
- datagerryDataGerry < 3.3.0 SSTI via DocAPI Template Rendering8.7 High
- cisco unified communications managerCisco Unified Communications Manager Cross-Site Scripting Vulnerability6.1 Medium
- eclipse foundation mojarraReflected XSS via client window id in URL client window mode6.1 Medium
- No product listedData::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping6.1 Medium
- brian mutende noptinWordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- easywpstuff remove google fonts – disable, block, or replace with bunny fonts for gdpr complianceRemove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer7.2 High
- coupa total spend management platformMultiple vulnerabilities in Coupa’s Total Spend Management Platform5.1 Medium
- wingerspeed slim jetpackSlim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field7.2 High
- elliotvs simple captcha with cloudflare turnstileSimple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- advancedcoding wpdiscuzWordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability7.1 High
- roland murg wp booking systemWordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability7.1 High
- awesomemotive contact form by wpformsWordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- unknown vikwidgetsloaderVikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks6.8 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute6.8 Medium
- unknown text typingText Typing < 2.2.2 - Contributor+ Stored XSS6.8 Medium
- shortpixel enable media replaceEnable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload6.4 Medium
- unknown duplicator, duplicator-pro +1 moreDuplicator < 5.1.0 - Reflected XSS via 'logname' Parameter5.8 Medium
- Show moreLoading…