Skip to content
Noroxi

CWE-79 · 49,650 records

Cross-site scripting

Why does it happen?

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

How to prevent it

  1. 01Insert user content as text, or encode it for its context.
  2. 02If HTML is required, pass it through a trusted sanitizer.
  3. 03Add a second layer of defense with a Content Security Policy header.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
commentEl.innerHTML = comment.body;

Fixed

ts
commentEl.textContent = comment.body;

Limit the impact of XSS

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Check security headers Web and API penetration testingRequest a quote

CVEs in this class

10,000 records

  • CVE-2019-3929
    99Now

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    crestron · am-100 firmwareApr 30, 2019

  • CVE-2024-42009
    92Now

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of

    CriticalCVSS 9.3KEVWeaponizedEPSS 82%

    roundcube · webmailAug 5, 2024

  • CVE-2023-34192
    89Now

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr

    CriticalCVSS 9.0KEVWeaponizedEPSS 77%

    synacor · zimbra collaboration suiteJul 6, 2023

  • CVE-2019-18426
    82Now

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s

    HighCVSS 8.2KEVWeaponizedEPSS 68%

    whatsapp · whatsappJan 21, 2020

  • CVE-2020-3580
    80Now

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

    MediumCVSS 6.1KEVWeaponizedEPSS 85%

    cisco · secure firewall threat defenseOct 21, 2020

  • CVE-2020-11023
    79This week

    Potential XSS vulnerability in jQuery

    MediumCVSS 6.1KEVWeaponizedEPSS 84%

    jquery · jqueryApr 29, 2020

  • CVE-2020-13965
    77This week

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.

    MediumCVSS 6.1KEVWeaponizedEPSS 76%

    roundcube · webmailJun 8, 2020

  • CVE-2024-37383
    76This week

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    MediumCVSS 6.1KEVWeaponizedEPSS 73%

    roundcube · webmailJun 7, 2024

  • CVE-2019-9978
    76This week

    The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter

    MediumCVSS 6.1KEVWeaponizedEPSS 72%

    warfareplugins · social warfareMar 24, 2019

  • CVE-2024-43573
    76This week

    Windows MSHTML Platform Spoofing Vulnerability

    HighCVSS 8.1KEVWeaponizedEPSS 46%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2026-42897
    75This week

    Microsoft Exchange Server Spoofing Vulnerability

    MediumCVSS 6.1KEVWeaponizedEPSS 70%

    microsoft · exchange serverMay 14, 2026

  • CVE-2023-5631
    74This week

    Stored XSS vulnerability in Roundcube

    MediumCVSS 5.4KEVWeaponizedEPSS 76%

    roundcube · webmailOct 18, 2023

  • CVE-2023-43770
    73This week

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of

    MediumCVSS 6.1KEVWeaponizedEPSS 63%

    roundcube · webmailSep 22, 2023

  • CVE-2023-37580
    69This week

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    MediumCVSS 6.1KEVWeaponizedEPSS 49%

    synacor · zimbra collaboration suiteJul 31, 2023

  • CVE-2022-39197
    67This week

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM

    MediumCVSS 6.1KEVWeaponizedEPSS 44%

    helpsystems · cobalt strikeSep 21, 2022

  • CVE-2013-5223
    66This week

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev.

    MediumCVSS 5.4KEVWeaponizedEPSS 50%

    dlink · dsl-2760u firmwareNov 19, 2013

  • CVE-2021-26829
    65This week

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

    MediumCVSS 5.4KEVWeaponizedEPSS 48%

    scadabr · scadabrJun 11, 2021

  • CVE-2022-28368
    64This week

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (with

    CriticalCVSS 9.8WeaponizedEPSS 83%

    dompdf project · dompdfApr 2, 2022

  • CVE-2023-49785
    64This week

    NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    nextchat · nextchatMar 11, 2024

  • CVE-2020-35730
    64This week

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.

    MediumCVSS 6.1KEVWeaponizedEPSS 32%

    roundcube · webmailDec 28, 2020

  • CVE-2018-19953
    63This week

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

    MediumCVSS 6.1KEVWeaponizedEPSS 30%

    qnap · qtsOct 28, 2020

  • CVE-2018-6882
    63This week

    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7

    MediumCVSS 6.1KEVWeaponizedEPSS 29%

    synacor · zimbra collaboration suiteMar 27, 2018

  • CVE-2025-68461
    62This week

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d

    MediumCVSS 6.1KEVWeaponizedEPSS 27%

    roundcube · webmailDec 18, 2025

  • CVE-2024-44309
    62This week

    A cookie management issue was addressed with improved state management.

    MediumCVSS 6.3KEVWeaponizedEPSS 21%

    debian · debian linuxNov 19, 2024

  • CVE-2024-11182
    61This week

    Stored XSS vulnerability in MDaemon Email Server

    MediumCVSS 5.3KEVWeaponizedEPSS 33%

    mdaemon · mdaemonNov 15, 2024

All vulnerability classes