CWE-80— Improper Neutralization of Script-Related HTML Tags

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.— MITRE CWE catalog

668 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-80page 3 of 14

CVE-2026-46492HIGHCVSS 6.1EG 7.2
2026-05-21
md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rende…
CVE-2025-14835HIGHCVSS 7.1EG 7.1
2026-01-07
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. Thi…
CVE-2025-60244HIGHCVSS 7.1EG 7.1
2025-11-06
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
CVE-2025-55291HIGHCVSS 7.1EG 7.1
2025-08-18
Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site …
CVE-2025-31384HIGHCVSS 7.1EG 7.1
2025-04-04
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5.
CVE-2025-22501HIGHCVSS 7.1EG 7.1
2025-03-28
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.
CVE-2024-46910HIGHCVSS 7.1EG 7.1
2025-02-13
An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which fixes the issue.
CVE-2025-24680HIGHCVSS 7.1EG 7.1
2025-01-27
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4…
CVE-2024-51689HIGHCVSS 7.1EG 7.1
2024-11-09
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflected XSS.This issue affects CF7 WOW Styler: from n/a through <= 1.6.8.
CVE-2024-44061HIGHCVSS 7.1EG 7.1
2024-10-20
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through…
CVE-2024-8981HIGHCVSS 7.1EG 7.1
2024-10-01
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and i…
CVE-2024-41656HIGHCVSS 7.1EG 7.1
2024-07-23
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry si…
CVE-2024-26282HIGHCVSS 7.1EG 7.1
2024-02-22
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
CVE-2024-26482HIGHCVSS 7.1EG 7.1
2024-02-22
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is back…
CVE-2024-25122HIGHCVSS 7.1EG 7.1
2024-02-13
sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin…
CVE-2024-23817HIGHCVSS 7.1EG 7.1
2024-01-25
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an att…
CVE-2021-32735HIGHCVSS 7.1EG 7.1
2021-07-02
Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scrip…
CVE-2026-50146HIGHCVSS 6.1EG 7.1
2026-06-16
Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attrib…
CVE-2025-64764HIGHCVSS 5.4EG 7.1
2025-11-19
Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has b…
CVE-2026-68919HIGHCVSS 7.0EG 7.0
2026-09-21
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage De…
CVE-2026-40875HIGHCVSS 7.0EG 7.0
2026-04-21
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Bec…
CVE-2025-51989HIGHCVSS 7.0EG 7.0
2025-08-21
HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" (firstname) field, which will be sent out in an email resulting in p…
CVE-2026-75872MEDIUMCVSS 6.9EG 6.9
2026-08-18
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's…
CVE-2026-54570MEDIUMCVSS 6.9EG 6.9
2026-07-17
AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding …
CVE-2025-8386MEDIUMCVSS 6.9EG 6.9
2025-11-15
The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, c…
CVE-2025-62418MEDIUMCVSS 4.8EG 6.9
2025-10-16
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When vi…
CVE-2025-62415MEDIUMCVSS 4.8EG 6.9
2025-10-16
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When v…
CVE-2025-62414MEDIUMCVSS 4.8EG 6.9
2025-10-16
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can …
CVE-2024-47139MEDIUMCVSS 6.8EG 6.8
2024-10-16
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the context of the currently logged-in user. …
CVE-2023-44396MEDIUMCVSS 6.8EG 6.8
2024-04-15
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
CVE-2022-36325MEDIUMCVSS 6.8EG 6.8
2022-08-10
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
CVE-2020-4047MEDIUMCVSS 6.8EG 6.8
2020-06-12
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a highe…
CVE-2019-5450MEDIUMCVSS 6.8EG 6.8
2019-07-30
Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.
CVE-2024-57004MEDIUMCVSS 6.1EG 6.6
2025-02-03
Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
CVE-2026-106163MEDIUMCVSS 6.5EG 6.5
2026-10-15
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-co…
CVE-2026-48910MEDIUMCVSS 6.5EG 6.5
2026-07-30
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive i…
CVE-2025-64225MEDIUMCVSS 6.5EG 6.5
2025-12-18
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects Stockie Extra: from n/a through <= 1.2.11.
CVE-2025-54348MEDIUMCVSS 6.5EG 6.5
2025-11-14
A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information.
CVE-2025-49398MEDIUMCVSS 6.5EG 6.5
2025-11-06
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14.
CVE-2025-52897MEDIUMCVSS 6.5EG 6.5
2025-07-30
GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
CVE-2025-39524MEDIUMCVSS 6.5EG 6.5
2025-04-16
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.
CVE-2025-31604MEDIUMCVSS 6.5EG 6.5
2025-03-31
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.
CVE-2025-31465MEDIUMCVSS 6.5EG 6.5
2025-03-28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornershop Better Section Navigation Widget better-section-navigation allows Stored XSS.This issue affects Better Section Navigation Widg…
CVE-2025-31075MEDIUMCVSS 6.5EG 6.5
2025-03-28
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.
CVE-2025-25363MEDIUMCVSS 6.5EG 6.5
2025-03-13
An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in c…
CVE-2025-24678MEDIUMCVSS 6.5EG 6.5
2025-01-24
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.
CVE-2025-24673MEDIUMCVSS 6.5EG 6.5
2025-01-24
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.
CVE-2024-6052MEDIUMCVSS 6.5EG 6.5
2024-07-03
Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements
CVE-2024-5741MEDIUMCVSS 6.5EG 6.5
2024-06-17
Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)
CVE-2023-49852MEDIUMCVSS 6.5EG 6.5
2024-06-04
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.…

Map vulnerabilities like CWE-80 to your infrastructure

EchelonGraph correlates every CVE — across CWE-80 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →