CWE-79

{
  "affected": [],
  "aliases": [
    "CVE-2025-48253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-19T15:15:28Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce allows Stored XSS. This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through 2.4.6.",
  "id": "GHSA-gp6h-4cq7-x6fq",
  "modified": "2026-04-01T18:35:08Z",
  "published": "2025-05-19T15:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48253"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/amount-left-free-shipping-woocommerce/vulnerability/wordpress-free-shipping-bar-amount-left-for-free-shipping-for-woocommerce-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-9660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-11T05:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html \"catname\" parameter.",
  "id": "GHSA-gp6h-wmwx-mv62",
  "modified": "2022-05-14T01:22:55Z",
  "published": "2022-05-14T01:22:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9660"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yzmcms/yzmcms/issues/12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-6972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-09-16T19:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group-summary.jsp.",
  "id": "GHSA-gp6j-6wfw-6chp",
  "modified": "2025-04-12T12:51:50Z",
  "published": "2022-05-17T02:38:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6972"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201612-50"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/38191"
    },
    {
      "type": "WEB",
      "url": "http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/133558/Openfire-3.10.2-Cross-Site-Scripting.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "openmage/magento-lts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0"
            },
            {
              "fixed": "20.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "openmage/magento-lts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-27T21:47:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nOpenMage is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.\n\n### Details\n`Mage_Adminhtml_Block_System_Config_Form_Field_File` does not escape filename value in certain situations.\nSame as: https://nvd.nist.gov/vuln/detail/CVE-2024-20717\n\n### PoC\n1. Create empty file with this filename: `\u003cimg src=x onerror=alert(1)\u003e.crt`\n2. Go to _System_ \u003e _Configuration_ \u003e _Sales | Payment Methonds_.\n3. Click **Configure** on _PayPal Express Checkout_.\n4. Choose **API Certificate** from dropdown _API Authentication Methods_.\n5. Choose the XSS-file and click **Save Config**.\n6. Profit, alerts \"1\" -\u003e XSS.\n7. Reload, alerts \"1\" -\u003e Stored XSS.\n\n### Impact\nAffects admins that have access to any fileupload field in admin in core or custom implementations.\nMalicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.\n",
  "id": "GHSA-gp6m-fq6h-cjcx",
  "modified": "2024-03-04T04:29:16Z",
  "published": "2024-02-27T21:47:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-gp6m-fq6h-cjcx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20717"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenMage/magento-lts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento LTS vulnerable to stored XSS in admin file form"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-22517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T16:15:46Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Ben Huson List Pages at Depth allows Stored XSS.This issue affects List Pages at Depth: from n/a through 1.5.",
  "id": "GHSA-gp6v-qqpw-37gp",
  "modified": "2026-04-01T18:33:03Z",
  "published": "2025-01-07T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22517"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/list-pages-at-depth/vulnerability/wordpress-list-pages-at-depth-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-45456"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-15T08:15:13Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in JoomUnited WP Meta SEO allows Stored XSS.This issue affects WP Meta SEO: from n/a through 4.5.13.",
  "id": "GHSA-gp73-hc78-3ch8",
  "modified": "2026-04-01T18:31:53Z",
  "published": "2024-09-16T14:37:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45456"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wp-meta-seo/vulnerability/wordpress-wp-meta-seo-plugin-4-5-13-cross-site-scripting-xss-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wp-meta-seo/wordpress-wp-meta-seo-plugin-4-5-13-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:extended-choice-parameter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "346.vd87693c5a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-02T21:29:59Z",
    "nvd_published_at": "2022-04-12T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.",
  "id": "GHSA-gp7c-xmmm-7pqr",
  "modified": "2023-10-27T17:18:34Z",
  "published": "2022-04-13T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29038"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/extended-choice-parameter-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Stored Cross-site Scripting vulnerabilities in Jenkins Extended Choice Parameter Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jsoup:jsoup"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36033"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-01T22:14:57Z",
    "nvd_published_at": "2022-08-29T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow cross-site scripting (XSS) attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible.\n\n### Impact\nSites that accept input HTML from users and use jsoup to sanitize that HTML, may be vulnerable to cross-site scripting (XSS) attacks, if they have enabled `SafeList.preserveRelativeLinks` and do not set an appropriate Content Security Policy.\n\n### Patches\nThis issue is patched in jsoup 1.15.3.\n\nUsers should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version.\n\n### Workarounds\nTo remediate this issue without immediately upgrading:\n\n- disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs\n- ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)\n\n### Background and root cause\njsoup includes a [Cleaner](https://jsoup.org/apidocs/org/jsoup/safety/Cleaner.html) component, which is designed to [sanitize input HTML](https://jsoup.org/cookbook/cleaning-html/safelist-sanitizer) against configurable safe-lists of acceptable tags, attributes, and attribute values.\n\nThis includes removing potentially malicious attributes such as `\u003ca href=\"javascript:...\"\u003e`, which may enable XSS attacks. It does this by validating URL attributes against allowed URL protocols (e.g. `http`, `https`).\n\nHowever, an attacker may be able to bypass this check by embedding control characters into the href attribute value. This causes the Java URL class, which is used to resolve relative URLs to absolute URLs before checking the URL\u0027s protocol, to treat the URL as a relative URL. It is then resolved into an absolute URL with the configured base URI.\n\nFor example, `java\\tscript:...` would resolve to `https://example.com/java\\tscript:...`.\n\nBy default, when using a safe-list that allows `a` tags, jsoup will rewrite any relative URLs (e.g. `/foo/`) to an absolute URL (e.g. `https://example.com/foo/`). Therefore, this attack attempt would be successfully mitigated. However, if the option [SafeList.preserveRelativeLinks](https://jsoup.org/apidocs/org/jsoup/safety/Safelist.html#preserveRelativeLinks(boolean)) is enabled (which does not rewrite relative links to absolute), the input is left as-is.\n\nWhile Java will treat a path like `java\\tscript:` as a relative path, as it does not match the allowed characters of a URL spec, browsers may normalize out the control characters, and subsequently evaluate it as a `javascript:` spec inline expression. That disparity then leads to an XSS opportunity.\n\nSites defining a Content Security Policy that does not allow javascript expressions in link URLs will not be impacted, as the policy will prevent the script\u0027s execution.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [jsoup](https://github.com/jhy/jsoup)\n* Email the author of jsoup at [jonathan@hedley.net](mailto:jonathan@hedley.net)\n\n### Credits\nThanks to Jens H\u00e4derer, who reported this issue, and contributed to its resolution.",
  "id": "GHSA-gp7f-rwcx-9369",
  "modified": "2022-11-04T20:35:22Z",
  "published": "2022-09-01T22:14:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36033"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jhy/jsoup"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3"
    },
    {
      "type": "WEB",
      "url": "https://jsoup.org/news/release-1.15.3"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20221104-0006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-07T08:16:10Z",
    "severity": "MODERATE"
  },
  "details": "The Consensus Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s consensus shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
  "id": "GHSA-gp7g-h2vp-5489",
  "modified": "2026-03-07T09:30:15Z",
  "published": "2026-03-07T09:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1823"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/consensus-embed/tags/1.6/consensus.php#L40"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/consensus-embed/tags/1.6/consensus.php#L43"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/consensus-embed/trunk/consensus.php#L40"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/consensus-embed/trunk/consensus.php#L43"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a20ef41d-7f01-4ef2-aae0-0b254ea78bc5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-20239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-12T13:16:30Z",
    "severity": "MODERATE"
  },
  "details": "MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the location hash parameter. Attackers can craft URLs with JavaScript payloads in the hash fragment that are parsed and rendered without sanitization, causing the injected scripts to execute in the victim\u0027s browser context.",
  "id": "GHSA-gp82-mmj7-m5w2",
  "modified": "2026-04-12T15:30:25Z",
  "published": "2026-04-12T15:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20239"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46097"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mdwiki-cross-site-scripting-via-location-hash-parameter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}