CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute6.4 Medium
- wpchill strong testimonialsStrong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter7.2 High
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form6.4 Medium
- agenwebsite shipping – plugin ongkos kirim & generate resi otomatis semua kurir indonesiaAgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard7.2 High
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer6.4 Medium
- rainbowgeek seopress – ai seo plugin & on-site seoSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters6.4 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field6.4 Medium
- unitecms unlimited elements for elementorUnlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget7.2 High
- unknown add from server liteAdd From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload6.8 Medium
- unknown live composerLive Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination6.8 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup7.5 High
- unknown live composerLive Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug3.5 Low
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.4 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.4 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.4 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.9 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.4 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.7 High
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name6.4 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass7.2 High
- bfintal stackable – page builder gutenberg blocksStackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter6.4 Medium
- webguyio stop spammers classicStop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter4.7 Medium
- pencidesign soledadSoledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields6.4 Medium
- qodeinteractive qode wishlist for woocommerceQODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie6.1 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- genetechproducts pie register – user registration, profiles & content restrictionPie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar7.2 High
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor7.2 High
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker7.2 High
- wpsoul greenshift – animation and page builder blocksGreenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix5.4 Medium
- jetmonsters motopress appointment bookingMotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint5.4 Medium
- gijo flying images: optimize and lazy load images for faster page speedFlying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2 High
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review6.4 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content5.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter5.4 Medium
- wpbakery page builderWPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name6.4 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field5.4 Medium
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 moreLifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer6.4 Medium
- themeisle social slider feed – social media feed & gallery widgetsSocial Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter6.4 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content7.2 High
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta5.4 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer7.2 High
- thimpress learnpress – course reviewLearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter6.4 Medium
- rabilal js help desk – ai-powered support & ticketing systemJS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title6.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value7.2 High
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter6.4 Medium
- gbif integrated publishing toolkitCross-site scripting in Integrated Publishing Toolkit4.8 Medium
- wpmu dev smush image compression and optimizationWordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jupyterlab jupyterlab-desktopJupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL9.4 Critical
- Show moreLoading…