← Back
CWE-79

46,885 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,885)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-4889
1Shareaholic
1Shareaholic
Jun 17, 2026
Nov 15, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user sup...Show more
The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-47446
1Phpgurukul
1Pre School Enrollment System
Jun 17, 2026
Nov 15, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.
CVE-2023-41597
1Eyoucms
1Eyoucms
Jun 17, 2026
Nov 15, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
CVE-2023-5987
1Schneider Electric
1Ecostruxure Power Monitoring Expert
Jun 17, 2026
Nov 15, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s...Show more
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload. Show less
CVE-2023-5985
1Schneider Electric
2Ion8650 Firmware
Ion8800 Firmware
Jun 17, 2026
Nov 15, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser when an attacker with admin privileges has modified system values.
CVE-2023-47309
1Nukium
1Gls
Jun 17, 2026
Nov 15, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile.
CVE-2023-47518
1Vfbpro
1Restrict Categories
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions.
CVE-2023-47517
1Pressified
1Sendpress
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.
CVE-2023-47532
1Themeum
1Wp Crowdfunding
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions.
CVE-2023-47528
1Sajjad67
1Wp Edit Username
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions.
CVE-2023-47524
1Codebard
1Patron Button And Widgets For Patreon
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.
CVE-2023-47522
1Photofeed
1Photo Feed
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions.
CVE-2023-47520
1Michaeluno
1Responsive Column Widgets
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions.
CVE-2023-46580
1Code Projects
1Inventory Management
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.
CVE-2023-46026
1Phpgurukul
1Teacher Subject Allocation Management System
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in profile.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary code via the 'adminname' and 'email' parameters.
CVE-2023-47549
1Spider Themes
1Eazydocs
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability on 302 response page in spider-themes EazyDocs plugin <= 2.3.3 versions.
CVE-2023-47547
1Wpfactory
1Products, Order & Customers Export For Woocommerce
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory Products, Order & Customers Export for WooCommerce plugin <= 2.0.7 versions.
CVE-2023-47546
1Walterpinem
1Oneclick Chat To Order
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Walter Pinem OneClick Chat to Order plugin <= 1.0.4.2 versions.
CVE-2023-47545
1Fatcatapps
1Forms For Mailchimp By Optin Cat
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin <= 2.5.4 versions.
CVE-2023-47544
1Atarim
2Atarim
Visual Collaboration
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin <= 3.12 versions.