Skip to content
CVE Tracker

CWE-80: Basic cross-site scripting

627 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

All 627 in the listAtom feed of new CVEsWhat CWE-80 is, at MITRE (opens in a new tab)
Published CVEs
627
Last 12 months
204
Critical
24
Known exploited
3

Critical 24High 92Medium 423Low 86Not scored 2

CVEs per yearBy the year they were published

  1. 201911
  2. 202238
  3. 202231
  4. 202216
  5. 202236
  6. 20221
  7. 20221
  8. 2026148
  9. 2026146
  10. 2026115
  11. 202664
  12. 202616

Known exploitedNewest addition to KEV first

  • CVE-2020-13965

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the…

    Product not named

    ExploitedMedium6.3
  • CVE-2018-19953

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following…

    QNAP Systems Inc. · QTS

    ExploitedMedium6.1
  • CVE-2018-19943

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the…

    QNAP Systems Inc. · QTS

    ExploitedHigh8.0

Newest CVEs

  • CVE-2026-116858

    WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

    WPMU DEV · Forminator

    Medium4.3
  • CVE-2026-52710

    WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability

    ithemelandco · GIFTiT &#8211; Free Gifts for WooCommerce

    Medium5.3
  • CVE-2026-62057

    WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

    Fahim Reza · Divi Contact Form 7

    Medium5.3
  • CVE-2026-119479

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability

    Crocoblock · JetFormBuilder

    Medium5.3
  • CVE-2026-42694

    WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

    Themeum · Kirki

    Medium4.3
  • CVE-2026-116402

    WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

    Brainstorm Force · SureForms

    Medium5.3
  • CVE-2026-48202

    WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

    Brave · Brave

    Medium5.3
  • CVE-2026-25467

    WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

    ThemeGrill · User Registration

    Medium5.3
  • CVE-2026-10511

    Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter

    artbees · Jupiter X Core

    Medium6.4
  • CVE-2026-116394

    WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

    Magepeople inc. · WpEvently

    Medium5.3

Vendors it comes up for most

  1. Cisco26
  2. IBM22
  3. QNAP Systems Inc.19
  4. unspecified16
  5. xwiki14
  6. Apache Software Foundation12
  7. Progress Software12
  8. Checkmk GmbH8
  9. Siemens8
  10. Siemens AG8