← Back
CWE-79

47,050 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,050)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-31862
1Jizhicms
1Jizhicms
Jun 17, 2026
May 19, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to pu...Show more
jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to publish an article containing malicious JavaScript scripts by modifying the request package.Show less
CVE-2023-29720
1Sofawiki Project
1Sofawiki
Jun 17, 2026
May 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
CVE-2023-30780
1Theguidex
1User Ip And Location
Jun 17, 2026
May 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TheGuideX User IP and Location plugin <= 2.2 versions.
CVE-2023-23999
1Monsterinsights
1Google Analytics Dashboard
Jun 17, 2026
May 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MonsterInsights plugin <= 8.14.0 versions.
CVE-2023-23667
1Berocket
1Brands For Woocommerce
Jun 17, 2026
May 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in BeRocket Brands for WooCommerce plugin <= 3.7.0.6 versions.
CVE-2022-47157
1Webhammer
1Wp Custom Fields Search
Jun 17, 2026
May 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Don Benjamin WP Custom Fields Search plugin <= 1.2.34 versions.
CVE-2023-32515
1Custom Field Suite Project
1Custom Field Suite
Jun 17, 2026
May 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Matt Gibbs Custom Field Suite plugin <= 2.6.2.1 versions.
CVE-2023-31233
1Baidu Tongji Generator Project
1Baidu Tongji Generator
Jun 17, 2026
May 18, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Haoqisir Baidu Tongji generator plugin <= 1.0.2 versions.
CVE-2023-30868
1Cms Tree Page View Project
1Cms Tree Page View
Jun 17, 2026
May 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.
CVE-2023-30487
1Thimpress
1Learnpress
Jun 17, 2026
May 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions.
CVE-2023-2757
1Plugin
1Waiting
Jun 17, 2026
May 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Sit...Show more
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for subscriber-level attackers to access functions to save plugin data that can potentially lead to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-30124
1Lavalite
1Lavalite
Jun 17, 2026
May 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-29837
1Exelysis
1Exelysis Unified Communications Solution
Jun 17, 2026
May 17, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page.
CVE-2023-2768
1Sucms Project
1Sucms
Jun 17, 2026
May 17, 2023
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in Sucms 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin_ads.php?action=add. The manipulation of the argument intro leads to cross s...Show more
A vulnerability was found in Sucms 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin_ads.php?action=add. The manipulation of the argument intro leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-229274 is the identifier assigned to this vulnerability.Show less
CVE-2023-31703
1Escanav
1Escan Management Console
Jun 17, 2026
May 17, 2023
N/A· v4
9.0 CRITICAL· v3
N/A· v2
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.
CVE-2023-31699
1Churchcrm
1Churchcrm
Jun 17, 2026
May 17, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
CVE-2023-31698
1Bludit
1Bludit
Jun 17, 2026
May 17, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot cre...Show more
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).Show less
CVE-2023-2753
1Phpmyfaq
1Phpmyfaq
Jun 17, 2026
May 17, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
CVE-2023-2752
1Phpmyfaq
1Phpmyfaq
Jun 17, 2026
May 17, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
CVE-2023-2509
1Asustor
3Adm
LooksgoodSoundsgood
Jun 17, 2026
May 17, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sens...Show more
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by the browser and used with that application. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below, LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below.Show less