← Back
CWE-79

47,010 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,010)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-29707
1Gbcom
1Lac Web Control Center
Jun 17, 2026
Jun 22, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
CVE-2023-28695
1Vigilantor Project
1Vigilantor
Jun 17, 2026
Jun 22, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions.
CVE-2023-28534
1Wpjobportal
1Wp Job Portal
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions.
CVE-2023-28496
1Smtp2go
1Smtp2go
Jun 17, 2026
Jun 22, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions.
CVE-2023-28423
1Prismtechstudios
1Modern Footnotes
Jun 17, 2026
Jun 22, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <= 1.4.15 versions.
CVE-2023-28171
1Wpchill
1Brilliance
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <= 1.3.1 versions.
CVE-2023-28166
1Tags Cloud Manager Project
1Tags Cloud Manager
Jun 17, 2026
Jun 22, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.
CVE-2023-27618
1Agilelogix
1Store Locator
Jun 17, 2026
Jun 22, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions.
CVE-2023-27631
1Mmrs151
1Daily Prayer Time
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.
CVE-2023-27629
1Geminilabs
1Site Reviews
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVE-2023-27612
1Geminilabs
1Site Reviews
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.
CVE-2023-27413
1W4 Post List Project
1W4 Post List
Jun 17, 2026
Jun 22, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions.
CVE-2019-25152
1Tychesoftwares
2Abandoned Cart Lite For Woocommerce
Abandoned Cart Pro For Woocommerce
Jun 17, 2026
Jun 22, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12....Show more
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.Show less
CVE-2023-33591
1User Registration & Login And User Management System Project
1User Registration & Login And User Management System
Jun 17, 2026
Jun 21, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php.
CVE-2023-33725
1Broadleafcommerce
1Broadleaf Commerce
Jun 17, 2026
Jun 21, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.
CVE-2023-27432
1Manage Upload Limit Project
1Manage Upload Limit
Jun 17, 2026
Jun 21, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WpSimpleTools Manage Upload Limit plugin <= 1.0.4 versions.
CVE-2023-27429
1Automattic
1Jetpack Crm
Jun 17, 2026
Jun 21, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions.
CVE-2023-27414
1Ays Pro
1Popup Box
Jun 17, 2026
Jun 21, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions.
CVE-2023-27450
1Te St
1Leyka
Jun 17, 2026
Jun 21, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.
CVE-2023-27443
1Simple Vimeo Shortcode Project
1Simple Vimeo Shortcode
Jun 17, 2026
Jun 21, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Grant Kimball Simple Vimeo Shortcode plugin <= 2.9.1 versions.