← Back
CWE-79

47,080 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,080)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-31804
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
CVE-2023-31803
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
CVE-2023-31802
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
CVE-2023-31801
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
CVE-2023-31800
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVE-2023-31799
1Chamilo
1Chamilo Lms
Jul 9, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
CVE-2023-31144
1Craftcms
1Craft Cms
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3...Show more
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.Show less
CVE-2021-31711
1Responsivefilemanager
1Responsivefilemanager
Jun 17, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Trippo ResponsiveFilemanager v.9.14.0 and before allows a remote attacker to execute arbitrary code via the sort_by parameter in the dialog.php file.
CVE-2020-18280
1Md Project
1Md
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.
CVE-2023-31126
1Xwiki
1Xwiki
Jun 17, 2026
May 9, 2023
N/A· v4
9.6 CRITICAL· v3
N/A· v2
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site sc...Show more
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.Show less
CVE-2023-23647
1Wpmart
1Team Member Team With Slider
Jun 17, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
CVE-2022-46864
1Woocommerce Custom Checkout Fields Editor With Drag & Drop Project
1Woocommerce Custom Checkout Fields Editor With Drag & Drop
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin <= 0.1 versions.
CVE-2022-46858
1Product Specifications For Woocommerce Project
1Product Specifications For Woocommerce
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Amin A.Rezapour Product Specifications for Woocommerce plugin <= 0.6.0 versions.
CVE-2022-46844
1Pixelgrade
1Pixfields
Jun 17, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.
CVE-2022-46822
1Jazzcash
1Woocommerce Jazzcash Gateway
Jun 17, 2026
May 9, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in JC Development Team WooCommerce JazzCash Gateway Plugin plugin <= 2.0 versions.
CVE-2023-24372
1Usbmemorydirect
1Simple Custom Author Profiles
Jun 17, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in USB Memory Direct Simple Custom Author Profiles plugin <= 1.0.0 versions.
CVE-2023-23884
1Kanbanwp
1Kanban Boards For Wordpress
Jun 17, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.
CVE-2023-23883
1Wp Content Filter Censor All Offensive Content From Your Site Project
1Wp Content Filter Censor All Offensive Content From Your Site
Jun 17, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Gwyer WP Content Filter plugin <= 3.0.1 versions.
CVE-2023-23862
1Vertical Scroll Recent Post Project
1Vertical Scroll Recent Post
Jun 17, 2026
May 9, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical scroll recent post plugin <= 14.0 versions.
CVE-2023-23734
1Userlike
1Userlike
Jun 17, 2026
May 9, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2 versions.