← Back
CWE-79

47,118 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,118)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-10013
1Kau Boys
1Backend Localization
Nov 21, 2024
Apr 24, 2023
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulati...Show more
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231.Show less
CVE-2023-26061
1Nokia
1Netact
Jun 17, 2026
Apr 24, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a sch...Show more
An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.Show less
CVE-2022-41612
1Shareaholic
1Similar Posts
Jun 17, 2026
Apr 24, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <= 3.1.6 versions.
CVE-2023-29848
1Hockeycomputindo
1Bang Resto
Jun 17, 2026
Apr 24, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function.
CVE-2022-47598
1Wp Super Popup Project
1Wp Super Popup
Jun 17, 2026
Apr 24, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions.
CVE-2022-47158
1Alfred24 Click & Collect Project
1Alfred24 Click & Collect
Jun 17, 2026
Apr 24, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions.
CVE-2022-45084
1Loginizer
1Loginizer
Jun 17, 2026
Apr 24, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.
CVE-2023-23892
1M Chart Project
1M Chart
Jun 17, 2026
Apr 24, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jamie Poitra M Chart plugin <= 1.9.4 versions.
CVE-2023-31045
1Backdropcms
2Backdrop
Backdrop Cms
Jun 17, 2026
Apr 24, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any conten...Show more
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."Show less
CVE-2023-27614
1Motor Racing League Project
1Motor Racing League
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions.
CVE-2023-27425
1Electric Studio Client Login Project
1Electric Studio Client Login
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in James Irving-Swift Electric Studio Client Login plugin <= 0.8.1 versions.
CVE-2023-25451
1Wpchill
1Cpo Content Types
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <= 1.1.0 versions.
CVE-2023-23832
1Ultimate Wp Query Search Filter Project
1Ultimate Wp Query Search Filter
Jun 17, 2026
Apr 23, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in TC Ultimate WP Query Search Filter plugin <= 1.0.10 versions.
CVE-2023-23827
1Google Maps V3 Shortcode Project
1Google Maps V3 Shortcode
Jun 17, 2026
Apr 23, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Google Maps v3 Shortcode plugin <= 1.2.1 versions.
CVE-2023-23817
1Simple Pdf Viewer Project
1Simple Pdf Viewer
Jun 17, 2026
Apr 23, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contrinbutor+) Cross-Site Scripting (XSS) vulnerability in WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin <= 1.9 versions.
CVE-2023-23816
1Sitemap Index Project
1Sitemap Index
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Twardes Sitemap Index plugin <= 1.2.3 versions.
CVE-2023-23806
1Wordpress Custom Settings Project
1Wordpress Custom Settings
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions.
CVE-2023-23717
1Portfolio Slideshow Project
1Portfolio Slideshow
Jun 17, 2026
Apr 23, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in George Gecewicz Portfolio Slideshow plugin <= 1.13.0 versions.
CVE-2023-24404
1Rarathemes
1Vryasage Marketing Performance
Jun 17, 2026
Apr 23, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.
CVE-2023-24386
1Ai Contact Us Form Project
1Ai Contact Us Form
Jun 17, 2026
Apr 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <= 1.0 versions.