CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability 5.3 Medium
- cool plugins formkit lite WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability 5.3 Medium
- crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability 5.3 Medium
- pluginus.net active products tables for woocommerce WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability 5.3 Medium
- david lingren media library assistant WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability 5.3 Medium
- stylemix masterstudy lms WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability 4.3 Medium
- metaphor creations, llc ditty WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability 4.3 Medium
- made with fuel better notifications for wp WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability 5.3 Medium
- gemini labs site reviews WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability 5.3 Medium
- wpdeveloper notificationx WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability 5.3 Medium
- profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 4.3 Medium
- brainstorm force cartflows WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability 5.3 Medium
- liquid web / stellarwp the events calendar WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability 5.3 Medium
- profilepress membership team profilepress WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 5.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.3 Medium
- mycred WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability 4.3 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor... 4.7 Medium
- fileorbis informatics services trade inc. fileorbis HTML Injection in Fileorbis 6.1 Medium
- coupa total spend management platform Multiple vulnerabilities in Coupa’s Total Spend Management Platform 5.1 Medium
- wpmu dev forminator WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability 4.3 Medium
- ithemelandco giftit – free gifts for woocommerce WordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability 5.3 Medium
- fahim reza divi contact form 7 WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability 5.3 Medium
- crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability 5.3 Medium
- themeum kirki WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability 4.3 Medium
- brainstorm force sureforms WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability 5.3 Medium
- brave WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability 5.3 Medium
- themegrill user registration WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability 5.3 Medium
- artbees jupiter x core Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter 6.4 Medium
- magepeople inc. wpevently WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability 5.3 Medium
- vitejs vite, vite-plus +1 more Vite: Cross origin script execution through Vite custom middleware 2.1 Low
- ibm cloud pak system IBM Cloud Pak System HTML Injection 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-site Scripting (XSS) in Kendo UI for jQuery Menu 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery 5.4 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery 4.7 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery 4.7 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery 4.7 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery 4.7 Medium
- progress kendo ui, progress software kendo ui for jquery +1 more Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser 6.5 Medium
- linuxfoundation vitess Vitess vttablet /twopcz reflected XSS 9.8 Critical
- elated-themes frappe Frappe before 13.46.1 XSS via html2text Weak Sanitization 5.9 Medium
- cohesity netbackup administration console web interface Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 6.1 Medium
- progress software kendo ui for vue Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue 5.4 Medium
- progress software kendoreact Cross-Site Scripting via Chart Tooltip in KendoReact 5.4 Medium
- izometri it services domestic and foreign trade co. ltd. eimzamip HTML Injection in İzometri Informatics' eimzamip 3.5 Low
- the wikimedia foundation mediawiki mediasearch extension attacker-controlled javascript license URL via XSS 1.2 Low
- the wikimedia foundation mediawiki commonsmetadata extension attacker-controlled javascript license URL via XSS 1.1 Low
- the wikimedia foundation mediawiki wikbase extension Various rawParams() and escaped() updates to prevent XSS in Wikibase extension 0.3 Low
- Show olderLoading…