Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-80: Basic cross-site scripting

646 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

All 646 in the listAtom feed of new CVEsWhat CWE-80 is, at MITRE (opens in a new tab)
Published CVEs
646
Last 12 months
216
Critical
24
Known exploited
3

Critical 24High 92Medium 442Low 86Not scored 2

CVEs per yearBy the year they were published

  1. 20061
  2. 20141
  3. 20186
  4. 20196
  5. 202033
  6. 202119
  7. 202279
  8. 202346
  9. 2024121
  10. 2025141
  11. 2026193

Known exploitedNewest addition to KEV first

  • CVE-2020-13965

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the…

    Product not named

    ExploitedMedium6.3
  • CVE-2018-19943

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the…

    QNAP Systems Inc. · QTS

    ExploitedHigh8.0
  • CVE-2018-19953

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following…

    QNAP Systems Inc. · QTS

    ExploitedMedium6.1

Newest CVEs

  • CVE-2026-123860

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Crocoblock · JetFormBuilder

    Medium5.3
  • CVE-2026-121777

    WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability

    Cool Plugins · Cool Formkit Lite

    Medium5.3
  • CVE-2026-123483

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Crocoblock · JetFormBuilder

    Medium5.3
  • CVE-2026-123183

    WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability

    PluginUs.Net · Active Products Tables for WooCommerce

    Medium5.3
  • CVE-2026-119496

    WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

    David Lingren · Media LIbrary Assistant

    Medium5.3
  • CVE-2026-119478

    WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

    StylemixThemes · MasterStudy LMS

    Medium4.3
  • CVE-2026-119492

    WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability

    Metaphor Creations, LLC · Ditty

    Medium4.3
  • CVE-2026-119490

    WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability

    Made with Fuel Ltd. · Better Notifications for WP

    Medium5.3
  • CVE-2026-119494

    WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability

    Gemini Labs · Site Reviews

    Medium5.3
  • CVE-2026-119507

    WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

    WPDeveloper · NotificationX

    Medium5.3

Vendors it comes up for most

  1. Cisco26
  2. IBM23
  3. QNAP Systems Inc.19
  4. unspecified16
  5. xwiki14
  6. Apache Software Foundation12
  7. Progress Software12
  8. Checkmk GmbH8
  9. Siemens8
  10. Siemens AG8