← Back
CWE-79

46,909 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,909)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-47659
1Lava Code
1Lava Directory Manager
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.
CVE-2023-6128
1Salesagility
1Suitecrm
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
CVE-2023-46099
1Siemens
1Simatic Pcs Neo
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with...Show more
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with high privileges to inject Javascript code into the application that is later executed by another legitimate user.Show less
CVE-2023-45881
1Gibbonedu
1Gibbon
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute o...Show more
GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response.Show less
CVE-2023-45879
1Gibbonedu
1Gibbon
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.
CVE-2023-42327
1Netgate
1Pfsense
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.
CVE-2023-42325
1Netgate
1Pfsense
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.
CVE-2023-31754
1Optimizely
1Optimizely Cms
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.
CVE-2023-47684
1Themepunch
1Essential Grid
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.
CVE-2023-47680
1Qodeinteractive
1Qi Addons For Elementor
Jun 17, 2026
Nov 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions.
CVE-2023-47673
1Thecrowned
1Post Pay Counter
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Stefano Ottolenghi Post Pay Counter plugin <= 2.784 versions.
CVE-2023-47665
1Plainviewplugins
1Plainview Protect Passwords
Jun 17, 2026
Nov 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in edward_plainview Plainview Protect Passwords plugin <= 1.4 versions.
CVE-2023-47662
1Goldbroker
1Live Gold Price & Silver Price Charts Widgets
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin <= 2.4 versions.
CVE-2023-47657
1Grandplugins
1Woo Quick View And Buy Now
Jun 17, 2026
Nov 14, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin <= 1.5.8 versions.
CVE-2023-4603
1Star Emea
1Star Cloudprnt For Woocommerce
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter in versions up to, and including, 2.0.3 due to insufficient input sanitization...Show more
The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.Show less
CVE-2023-47697
1Wp Eventmanager
1Wp Event Manager
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin <= 3.1.39 versions.
CVE-2023-47696
1Gravitymaster
1Product Enquiry For Woocommerce
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions.
CVE-2023-47695
1Scribit
1Shortcodes Finder
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Shortcodes Finder plugin <= 1.5.3 versions.
CVE-2023-47690
1Antonbond
1Additional Order Filters For Woocommerce
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin <= 1.10 versions.
CVE-2023-46020
1Code Projects
1Blood Bank
Jun 17, 2026
Nov 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'remail', 'rphone' and 'rcity' parameters.