CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- geonodeGeoNode has Stored XSS in Documents metadata abstract field6.3 Medium
- open-wanderer wandererWanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML7.6 High
- open-wanderer wandererStored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)7.6 High
- ohif viewersOHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document8.8 High
- freescout-help-desk freescoutFreeScout: Conditional stored admin XSS via failed-job details7.5 High
- progress software kendo ui for vueCross-Site Scripting in Progress Software Kendo UI for Vue5.4 Medium
- progress software kendoreactCross-Site Scripting in Progress Software KendoReact5.4 Medium
- progress software kendo ui for angularCross-Site Scripting in Progress Software Kendo UI for Angular5.4 Medium
- progress software kendoreactCross-Site Scripting in Progress Software KendoReact5.4 Medium
- freescout-help-desk freescoutFreeScout: Stored XSS in mailbox signature via same-origin JS upload7.6 High
- progress software kendoreactCross-Site Scripting in Progress Software KendoReact5.4 Medium
- progress software kendo ui for angularCross-Site Scripting in Progress Software Kendo UI for Angular5.4 Medium
- progress software progress® telerik® fiddler® everywhereCross-site Scripting in Progress Telerik Fiddler Everywhere7.3 High
- userminUsermin through 2.570 XSS via mailbox detach.cgi type Parameter5.1 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title5.4 Medium
- themekraft buddyformsBuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion5.4 Medium
- nicola modugno smart cookie kitSmart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration5.4 Medium
- progressplanner aaa autoload optimizerAAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook4.9 Medium
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field6.4 Medium
- aguilatechnologies wp customer areaWP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter6.4 Medium
- ericsson codecheckerStored XSS in the static HTML report export, because json.dumps does not escape the markup character0.0 None
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web...6.1 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was...8.2 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link5.4 Medium
- man4toman parsi date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیتWp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute6.4 Medium
- realmag777 mdtf – meta data and taxonomies filterMDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter7.2 High
- wpusermanager wp user manager – registration form, login form, user profile builder & member directoryWP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta6.4 Medium
- maciej bis permalink manager litePermalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug6.4 Medium
- barn2 plugins posts table with search & sortPosts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute6.4 Medium
- iqonicdesign graphina – charts and graphs for elementorGraphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings7.2 High
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute6.4 Medium
- infinitt healthcare uliteReflected XSS in INFINITT ULite login error page (pre-auth)6.1 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- genetech products pie registerWordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability7.1 High
- david anderson redux frameworkWordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hclsoftware bigfix mcm & mobileBigFix Mobile is affected by a Cross-site scripting vulnerability6.3 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation8.0 High
- unknown shopengine gutenberg woocommerce builder blocks addonBlocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css6.8 Medium
- unknown anti-spam, spam firewall by cleantalkAnti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email7.5 High
- unknown advanced custom fields (acf®)Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection7.5 High
- unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + moreiubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser7.5 High
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta8.0 High
- ataur r gutenkitGutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS6.8 Medium
- unknown mcbMCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent8.8 High
- foxit software inc. workspaceFoxit Workspace Stored XSS in shared artifacts8.7 High
- kubeflow pipelinesKubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses6.1 Medium
- altair-graphql altair, altair-express-middleware, altair-fastify-plugin +2 more +4 moreAltair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox6.1 Medium
- Show moreLoading…