Cross-site scripting vulnerabilities
A web page includes attacker-controlled script, which then runs in other people's browsers with their session and permissions.
Cross-site scripting in numbers
sbomify tracks 54,178 cross-site scripting vulnerabilities. Most are found in web application (50%), cms plugin (35%) and server software (7%).
How to fix cross-site scripting vulnerabilities
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix.
Most exploited cross-site scripting vulnerabilities
- CVE-2022-42948 Fortra Cobalt Strike User Interface Remote Code Execution
- CVE-2024-42009 RoundCube Webmail Cross-Site Scripting
- CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)
- CVE-2019-18426 WhatsApp Cross-Site Scripting
- CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting
- CVE-2018-19943 QNAP NAS File Station Cross-Site Scripting
- CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting
- CVE-2025-68461 RoundCube Webmail Cross-site Scripting
- CVE-2020-11023 JQuery Cross-Site Scripting (XSS)
- CVE-2024-43573 Microsoft Windows MSHTML Platform Spoofing
- CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS)
- CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS)
Recently published
- CVE-2023-38375 IBM Cloud Pak System Cross-Site Scripting
- CVE-2025-6623 Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
- CVE-2026-106933 Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
- CVE-2026-110379 WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-111059 Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
- CVE-2026-111407 WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
Other types of vulnerability
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.