CWE-80


Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

We have discovered 1,907,916 live websites that are affected by CWE-80.

Contact us to get more info







CVEs

  • Count - 80



Website Distribution by Country

Number of websites using CWE-80
United States524,902 websites


Germany180,939 websites
France105,068 websites
Italy93,691 websites
GB86,228 websites
Spain64,734 websites
Netherlands63,211 websites
Japan56,353 websites
Russia50,816 websites
Poland48,377 websites

Website Distribution by TLD

Number of websites using CWE-80
.com791,761 websites
.de101,897 websites
.org79,262 websites
.it66,925 websites
.nl56,165 websites
.co.uk51,992 websites
.fr44,755 websites
.net43,953 websites
.ru41,425 websites
.pl36,831 websites

Newest CVEs

List of the most recent CVEs that are part of CWE-80
DiscoveredCVEDescriptionWebsites
Sep, 2026CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability547,042
Sep, 2026CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki95
Sep, 2026CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki95
Jul, 2026CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization166
Jul, 2026CVE-2026-48910 Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing23
Jul, 2026CVE-2026-57167 PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)287
Jun, 2026CVE-2026-50229 Apache Tomcat: XSS in number guess example4,975
Jun, 2026CVE-2026-52816 Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS38
Jun, 2026CVE-2026-50146 Astro: Reflected XSS via unescaped slot name25,023
Jun, 2026CVE-2026-34033 Apache Answer: HTML Content Injection in Email8

The most widespread CVEs

List of the most common CVEs that are part of CWE-80
DiscoveredCVEDescriptionWebsites
Oct, 2025CVE-2025-11160 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module956,350
Oct, 2025CVE-2025-11161 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode956,350
Sep, 2026CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability547,042
Jun, 2020CVE-2020-4046 Authenticated XSS through embed block in WordPress207,580
Jun, 2020CVE-2020-4047 Authenticated XSS via media attachment page in WordPress207,580
Jun, 2020CVE-2020-4049 Authenticated self-XSS via theme uploads in WordPress207,580
Aug, 2023CVE-2022-4953 Elementor < 3.5.5 - Iframe Injection142,639
Sep, 2024CVE-2024-8680 MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting42,755
Jun, 2026CVE-2026-50146 Astro: Reflected XSS via unescaped slot name25,023
Nov, 2025CVE-2025-11265 VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting18,453

Websites affected by CWE-80

Top websites that are affected by CWE-80. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.net Canada***
*********.com United States***
***.********.com United States***
*****.com United States***
**.cn China***
*********.net United States***
************.com United States*,***
*******.com United States*,***
*******.com United States*,***
********.jp Japan*,***
See full domain list