← Back
CWE-79

46,934 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,934)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-45958
1Thirtybees
1Thirty Bees
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execut...Show more
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.Show less
CVE-2023-5631
3Debian
FedoraprojectRoundcube
3Debian Linux
FedoraWebmail
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a...Show more
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.Show less
CVE-2023-45632
1Web Dorado
1Spidervplayer
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.
CVE-2023-45630
1Wpdevart
1Gallery
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.
CVE-2023-45628
1Qrokes
1Qr Twitter Widget
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.
CVE-2023-45607
1Wordpress Popular Posts Project
1Wordpress Popular Posts
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.
CVE-2023-45604
1Get Custom Field Values Project
1Get Custom Field Values
Jun 17, 2026
Oct 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.
CVE-2023-45602
1Shopfiles
1Ebook Store
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.
CVE-2023-30781
1Themeblvd
1Tweeple
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.
CVE-2023-45608
1Nicolamodugno
1Smart Cookie Kit
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions.
CVE-2023-45073
1Kochm
1Mendeley Plugin
Jun 17, 2026
Oct 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.
CVE-2023-45072
1Order Auto Complete For Woocommerce Project
1Order Auto Complete For Woocommerce
Jun 17, 2026
Oct 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.
CVE-2023-45071
110web
1Form Maker
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.
CVE-2023-45070
110web
1Form Maker
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.
CVE-2023-45067
1Freelancer Coder
1Wordpress Simple Html Sitemap
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
CVE-2023-45065
1Madfishdigital
1Bulk Noindex & Nofollow Toolkit
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions.
CVE-2023-31217
1User Location And Ip Project
1User Location And Ip
Jun 17, 2026
Oct 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.
CVE-2023-32089
1Pega
1Platform
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
CVE-2023-32088
1Pega
1Platform
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
CVE-2023-32087
1Pega
1Platform
Jun 17, 2026
Oct 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation