Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,010)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-35775 1Wp Backup Solutions Project 1Wp Backup Solutions Jun 17, 2026 Jun 19, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Backup Solutions WP Backup Manager plugin <= 1.13.1 versions.
CVE-2023-35772 1Google Map Shortcode Project 1Google Map Shortcode Jun 17, 2026 Jun 19, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alain Gonzalez Google Map Shortcode plugin <= 3.1.2 versions.
CVE-2023-3318 1Resort Management System Project 1Resort Management System Jun 17, 2026 Jun 19, 2023 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cr...Show more A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231937 was assigned to this vulnerability.Show less
CVE-2023-33213 1Gvectors 1Wpview Jun 17, 2026 Jun 19, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions.
CVE-2023-2527 1Crmperks 1Integration For Contact Form 7 And Zoho Crm, Bigin Jun 17, 2026 Jun 19, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high pr...Show more The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as adminShow less
CVE-2023-0368 1Responsive Tabs For Wpbakery Page Builder Project 1Responsive Tabs For Wpbakery Page Builder Jun 17, 2026 Jun 19, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho...Show more The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksShow less
CVE-2023-34657 1Eyoucms 1Eyoucms Jun 17, 2026 Jun 19, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web_recordnum parameter.
CVE-2023-3311 1Online Shopping System Advanced Project 1Online Shopping System Advanced Jun 17, 2026 Jun 18, 2023 N/A· v4 5.4 MEDIUM· v3 3.3 LOW· v2 A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First nam...Show more A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807.Show less
CVE-2023-3309 1Resort Reservation System Project 1Resort Reservation System Jun 17, 2026 Jun 18, 2023 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file ?page=rooms of the component Manage Room Page. T...Show more A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file ?page=rooms of the component Manage Room Page. The manipulation of the argument Cottage Number leads to cross site scripting. The attack can be launched remotely. The identifier VDB-231805 was assigned to this vulnerability.Show less
CVE-2023-33438 1Wolterskluwer 1Teammate+ Jul 9, 2026 Jun 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML.
CVE-2023-30453 1Teamlead 1Reminder Jun 17, 2026 Jun 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter.
CVE-2023-35783 1Faceted Search Project 1Faceted Search Jun 17, 2026 Jun 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
CVE-2023-3294 1Saleor 1React Storefront Jun 17, 2026 Jun 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
CVE-2023-26537 1Wp No External Links Project 1Wp No External Links Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nicolly WP No External Links plugin <= 1.0.2 versions.
CVE-2023-26527 1Wpindeed 1Debug Assistant Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.
CVE-2023-25974 1Wp2syslog Project 1Wp2syslog Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in psicosi448 wp2syslog plugin <= 1.0.5 versions.
CVE-2023-3293 1Salesagility 1Suitecrm Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
CVE-2023-27420 1Everestthemes 1Arya Multipurpose Jun 17, 2026 Jun 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose theme <= 1.0.5 versions.
CVE-2023-26515 1Simple Slug Translate Project 1Simple Slug Translate Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ko Takagi Simple Slug Translate plugin <= 2.7.2 versions.
CVE-2023-26541 1Asmember Project 1Asmember Jun 17, 2026 Jun 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Suess asMember plugin <= 1.5.4 versions.

Previous 1...121212131214...2351 Next