Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,142)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-15029 1Mapicoin Project 1Mapicoin Nov 21, 2024 Mar 21, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cro...Show more A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.10.0 is able to address this issue. The patch is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-223402 is the identifier assigned to this vulnerability.Show less
CVE-2022-42485 1Galaxyweblinks 1Gallery With Thumbnail Slider Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
CVE-2022-41831 1Wp Glossary Project 1Wp Glossary Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
CVE-2022-41785 1Robogallery 1Gallery Images Ape Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
CVE-2023-1536 1Answer 1Answer Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
CVE-2023-1535 1Answer 1Answer Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
CVE-2023-1527 1Corebos 1Corebos Jun 17, 2026 Mar 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
CVE-2023-22288 2Checkmk Tribe29 2Checkmk Checkmk Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails
CVE-2023-1517 1Pimcore 1Pimcore Jun 17, 2026 Mar 20, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
CVE-2023-0370 1Wpbean 1Wpb Advanced Faq Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the...Show more The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-0369 1Gotowp 1Gotowp Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributo...Show more The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-0365 1React Webcam Project 1React Webcam Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the cont...Show more The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-0364 1Real.kit Project 1Real.kit Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contribut...Show more The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-0145 1Saan 1World Clock Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co...Show more The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less
CVE-2023-28429 1Pimcore 1Pimcore Jun 17, 2026 Mar 20, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie a...Show more Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.Show less
CVE-2023-1515 1Pimcore 1Pimcore Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
CVE-2023-0320 1University Information Management System Project 1University Information Management System Jun 17, 2026 Mar 20, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi University UBYS allows Stored XSS. This issue affects UBYS: before 23.03.16.
CVE-2022-47591 1Map Multi Marker Project 1Map Multi Marker Jun 17, 2026 Mar 20, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
CVE-2023-23718 1Page Loading Effects Project 1Page Loading Effects Jun 17, 2026 Mar 20, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Esstat17 Page Loading Effects plugin <= 2.0.0 versions.
CVE-2023-22682 1Pixedelic 1Camera Slideshow Jun 17, 2026 Mar 20, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia \| Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.

Previous 1...127912801281...2358 Next