Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,992)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-32965 1Crudlab 1Jazz Popups Jun 17, 2026 Jul 18, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions.
CVE-2023-2433 1Yarpp 1Yet Another Related Posts Plugin Jun 17, 2026 Jul 18, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it pos...Show more The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-3708 1Deothemes 5Amela ArendelleEverse+2 more Jun 17, 2026 Jul 18, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauth...Show more Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.Show less
CVE-2021-37386 1Furukawa 4423 41w/ac Firmware Ld420 10r FirmwareLd421 21w Firmware+1 more Jun 17, 2026 Jul 17, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Furukawa Electric LatAm 423-41W/AC before v1.1.4 and LD421-21W before v1.3.3 were discovered to contain an HTML injection vulnerability via the serial number update function.
CVE-2023-36656 1Jaegertracing 1Jaeger Ui Jun 17, 2026 Jul 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.
CVE-2023-31853 1Cudy 1Lt400 Firmware Jun 17, 2026 Jul 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.
CVE-2023-31851 1Cudy 1Lt400 Firmware Jun 17, 2026 Jul 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.
CVE-2023-3245 1Premio 1Chaty Jun 17, 2026 Jul 17, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...Show more The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)Show less
CVE-2023-31852 1Cudy 1Lt400 Firmware Jun 17, 2026 Jul 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.
CVE-2023-2960 1Olivaekspertiz 1Oliva Ekspertiz Jun 17, 2026 Jul 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting (XSS). This issue affects Oliva Expertise EKS: before...Show more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting (XSS). This issue affects Oliva Expertise EKS: before 1.2.Show less
CVE-2023-1893 1Login Configurator Project 1Login Configurator Jun 17, 2026 Jul 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
CVE-2023-3691 1Layui 1Layui Jun 17, 2026 Jul 16, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross sit...Show more A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.Show less
CVE-2023-3685 1Nesote 1Inout Search Engine Ai Edition Jun 17, 2026 Jul 16, 2023 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation of the argument page leads to cross sit...Show more A vulnerability was found in Nesote Inout Search Engine AI Edition 1.1. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-234231. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-3683 1Livelyworks 1Articart Jun 17, 2026 Jul 16, 2023 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_te...Show more A vulnerability has been found in LivelyWorks Articart 2.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /items/search. The manipulation of the argument search_term leads to cross site scripting. The attack can be launched remotely. The identifier VDB-234229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-2507 1Clevertap 1Clevertap Jun 17, 2026 Jul 15, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does...Show more CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.Show less
CVE-2023-3681 1Retro Cellphone Online Store Project 1Retro Cellphone Online Store Jun 17, 2026 Jul 15, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/modal_add_product.php. The manipulation of the argument descri...Show more A vulnerability classified as problematic was found in Campcodes Retro Cellphone Online Store 1.0. This vulnerability affects unknown code of the file /admin/modal_add_product.php. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-234226 is the identifier assigned to this vulnerability.Show less
CVE-2023-38350 1Pnp4nagios 1Pnp4nagios Jun 17, 2026 Jul 15, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
CVE-2023-37223 1Archerirm 1Archer Jun 17, 2026 Jul 14, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.
CVE-2023-24896 1Microsoft 1Dynamics 365 Jun 17, 2026 Jul 14, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Dynamics 365 Finance Spoofing Vulnerability
CVE-2023-3672 1Plaidweb 1Webmention.js Jun 17, 2026 Jul 14, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5.

Previous 1...119311941195...2350 Next