← Back
CWE-79

47,066 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,066)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-22696
1Custom4web
1Affiliate Links Lite
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Custom4Web Affiliate Links Lite plugin <= 2.5 versions.
CVE-2022-32970
1Themify
1Portfolio Post
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.
CVE-2023-28932
1Amauri
1Wpmobile.app
Jun 17, 2026
May 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.
CVE-2023-24418
1Gopiplus
1Tiny Carousel Horizontal Slider Plus
Jun 17, 2026
May 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions.
CVE-2023-24392
1I13websolution
1Full Width Banner Slider Wp
Jun 17, 2026
May 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Full Width Banner Slider Wp plugin <= 1.1.7 versions.
CVE-2023-23812
1Enhanced Wp Contact Form Project
1Enhanced Wp Contact Form
Jun 17, 2026
May 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions.
CVE-2023-23789
1Premmerce
1Premmerce Redirect Manager
Jun 17, 2026
May 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
CVE-2023-23788
1Custom More Link Complete Project
1Custom More Link Complete
Jun 17, 2026
May 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Florin Arjocu Custom More Link Complete plugin <= 1.4.1 versions.
CVE-2023-23786
1Servit
1Affiliate Toolkit
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions.
CVE-2023-23701
1Web Design Easy Sign Up Project
1Web Design Easy Sign Up
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin <= 3.4.1 versions.
CVE-2023-22711
1Agentevolution
1Impress Listings
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Agent Evolution IMPress Listings plugin <= 2.6.2 versions.
CVE-2023-30777
1Advancedcustomfields
1Advanced Custom Fields
Jun 17, 2026
May 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
CVE-2023-2615
1Pimcore
1Pimcore
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2614
1Pimcore
1Pimcore
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-27918
1Tms Outsource
1Amelia
Jun 17, 2026
May 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is...Show more
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.Show less
CVE-2023-27888
1Sitebridge
1Joruri Gw
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.
CVE-2023-2616
1Pimcore
1Pimcore
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-25833
1Esri
1Portal For Arcgis
Jun 17, 2026
May 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the vi...Show more
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).Show less
CVE-2023-30057
1Fico
1Origination Manager Decision
Jul 9, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2023-25831
1Esri
1Portal For Arcgis
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary...Show more
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.Show less