Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,946)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-44042 1Blackcat Cms 1Blackcat Cms Jun 17, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website header parameter.
CVE-2023-43857 1Iteachyou 1Dreamer Cms Jun 17, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
CVE-2023-43830 1Intelliants 1Subrion Jun 17, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum depos...Show more A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.Show less
CVE-2023-43828 1Intelliants 1Subrion Jun 17, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.
CVE-2023-43614 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2023-43484 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2023-43331 1Small Crm Project 1Small Crm Jun 17, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2023-43263 1Froala 1Froala Editor Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.
CVE-2023-43232 1Dedebiz 1Dedebiz Jul 9, 2026 Sep 27, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title param...Show more A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.Show less
CVE-2023-41962 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script in the page.
CVE-2023-41861 1Tickera 1Restrict Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Restrict plugin <= 2.2.4 versions.
CVE-2023-41860 1Travelmap 1Travelmap Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Cross-Site Scripting (XSS) vulnerability in TravelMap plugin <= 1.0.1 versions.
CVE-2023-41653 1Bearthemes 1Sermon'e Sermons Online Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.
CVE-2023-41242 1Creativehassan 1Snap Pixel Jun 17, 2026 Sep 27, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions.
CVE-2023-41241 1Surecart 1Surecart Jun 17, 2026 Sep 27, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.
CVE-2023-41238 1Ultimatelysocial 1Social Media Share Buttons & Social Sharing Icons Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.
CVE-2023-41237 1Everestthemes 1Arya Multipurpose Theme Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose Pro theme <= 1.0.8 versions.
CVE-2023-41236 1Wedevs 1Happy Addons For Elementor Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <= 2.8.0 versions.
CVE-2023-41235 1Everestthemes 1Everest News Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Everest News Pro theme <= 1.1.7 versions.
CVE-2023-41233 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker to inject an arbitrary script.

Previous 1...114711481149...2348 Next