← Back
CWE-79

47,141 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,141)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-23898
1Creativethemes
1Blocksy Companion
Jun 17, 2026
Apr 6, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeThemes Blocksy Companion plugin <= 1.8.67 versions.
CVE-2023-24004
1Wpdevart
1Download Image And Video Lightbox, Image Popup
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions.
CVE-2023-24003
1Timersys
1Wp Popups
Jun 17, 2026
Apr 6, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions.
CVE-2023-24002
1Wpdevart
1Youtube Embed, Playlist And Popup
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions.
CVE-2023-24006
1Linksoftwarellc
1Wp Terms Popup
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Link Software LLC WP Terms Popup plugin <= 2.6.0 versions.
CVE-2023-24001
2Modal Dialog Project
Ylefebvre
2Modal Dialog
Modal Dialog
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.9 versions.
CVE-2023-23998
1E4jconnect
1Vikrentcar
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions.
CVE-2023-23996
1Properfraction
1Profilepress
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions.
CVE-2023-23980
1Mailoptin
1Mailoptin
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MailOptin Popup Builder Team MailOptin plugin <= 1.2.54.0 versions.
CVE-2023-23987
1Wpeverest
1User Registration
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions.
CVE-2023-23979
1Fullworksplugins
1Quick Event Manager
Jun 17, 2026
Apr 6, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.
CVE-2023-23972
1Wpdevart
1Social Like Box And Page
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions.
CVE-2023-23971
1Codepeople
1Wp Time Slots Booking Form
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions.
CVE-2023-23982
1Wpfrom Email Project
1Wpfrom Email
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGear.Pro WPFrom Email plugin <= 1.8.8 versions.
CVE-2023-23981
1Quantumcloud
1Conversational Forms For Chatbot
Jun 17, 2026
Apr 6, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud Conversational Forms for ChatBot plugin <= 1.1.6 versions.
CVE-2023-23815
1Multi Column Tag Map Project
1Multi Column Tag Map
Jun 17, 2026
Apr 6, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Jackson Multi-column Tag Map plugin <= 17.0.24 versions.
CVE-2022-31889
1Enhancesoft
1Audit Log
Jun 17, 2026
Apr 5, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
CVE-2023-24747
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Apr 5, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.
CVE-2023-0523
1Gitlab
1Gitlab
Jun 17, 2026
Apr 5, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.
CVE-2022-3513
1Gitlab
1Gitlab
Jun 17, 2026
Apr 5, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload...Show more
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.Show less