Weakness class · XSS
Cross-site Scripting
50,260 published CVEs name a weakness in this class; 33 of them are exploited in the wild.
CWEs in this class10
| CWE | Weakness | CVEs | Exploited | Check |
|---|---|---|---|---|
| CWE-79 | Cross-site Scripting | 49,454 | 29 | 981 |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | 663 | 3 | 10 |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | 49 | 0 | 5 |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | 35 | 0 | 0 |
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | 21 | 1 | 0 |
| CWE-86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | 11 | 0 | 0 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | 9 | 0 | 1 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | 9 | 0 | 0 |
| CWE-692 | Incomplete Denylist to Cross-Site Scripting | 7 | 0 | 0 |
| CWE-85 | Doubled Character XSS Manipulations | 2 | 0 | 0 |
Exploited and check counts are given for the class's largest CWEs; open a CWE for its CVEs.
Data as of 2026-11-14.