Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,970)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-3136 1Perfopsone 1Mailarchiver Jun 17, 2026 Aug 30, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it p...Show more The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-4599 1Wp Webhooks 1Email Encoder Jun 17, 2026 Aug 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on use...Show more The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was issued in version 2.1.8. The vulnerability was fully patched in 2.1.9.Show less
CVE-2023-4597 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Aug 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on...Show more The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-39558 1Web Audimex 1Audimexee Jun 17, 2026 Aug 29, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
CVE-2023-4296 1Intland 1Codebeamer Jun 17, 2026 Aug 29, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
CVE-2023-41153 1Webmin 1Usermin Jun 17, 2026 Aug 29, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options...Show more A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.Show less
CVE-2023-38971 1Uatech 1Badaso Jun 17, 2026 Aug 29, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
CVE-2023-32241 1Wpdeveloper 1Essential Addons For Elementor Jun 17, 2026 Aug 29, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPDeveloper Essential Addons for Elementor Pro plugin <= 5.4.8 versions.
CVE-2023-39678 1Bdcom 1P3310d 2ac Firmware Jun 17, 2026 Aug 29, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected...Show more A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.Show less
CVE-2023-39266 1Hpe 1Arubaos Switch Jun 17, 2026 Aug 29, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configu...Show more A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Show less
CVE-2023-40170 1Jupyter 1Jupyter Server Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Ope...Show more jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.Show less
CVE-2023-38969 1Uatech 1Badaso Jun 17, 2026 Aug 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.
CVE-2023-39578 1Tribalsystems 1Zenario Jun 17, 2026 Aug 28, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
CVE-2023-39709 1Free And Open Source Inventory Management System Project 1Free And Open Source Inventory Management System Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Addres...Show more Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.Show less
CVE-2023-39062 1Html2pdf Project 1Html2pdf Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
CVE-2020-27366 1Humaxdigital 1Hgb10r 02 Firmware Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in wlscanresults.html in Humax HGB10R-02 BRGCAB version 1.0.03, allows local attackers to execute arbitrary code.
CVE-2023-39708 1Free And Open Source Inventory Management System Project 1Free And Open Source Inventory Management System Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parame...Show more A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.Show less
CVE-2023-40755 1Phpjabbers 1Callback Widget Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0.
CVE-2023-40753 1Phpjabbers 1Ticket Support Script Jun 17, 2026 Aug 28, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
CVE-2023-40752 1Phpjabbers 1Make An Offer Widget Jun 17, 2026 Aug 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.

Previous 1...116611671168...2349 Next