Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,142)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-1470 1Implecode 1Ecommerce Product Catalog Jun 17, 2026 Mar 17, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and outpu...Show more The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.Show less
CVE-2022-45817 1Gc Testimonials Project 1Gc Testimonials Jun 17, 2026 Mar 17, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.
CVE-2022-45814 1Wp Calendar Project 1Wp Calendar Jun 17, 2026 Mar 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored Cross-Site Scripting (XSS) vulnerability in Fabian von Allmen WP Calendar plugin <= 1.5.3 versions.
CVE-2022-43461 1Slideshow Se Project 1Slideshow Se Jun 17, 2026 Mar 17, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
CVE-2023-1447 1Medicine Tracker System Project 1Medicine Tracker System Jun 17, 2026 Mar 17, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability, which was classified as problematic, has been found in SourceCodester Medicine Tracker System 1.0. Affected by this issue is some unknown functionality of the file app/?page=medicines/manage_medicine. Th...Show more A vulnerability, which was classified as problematic, has been found in SourceCodester Medicine Tracker System 1.0. Affected by this issue is some unknown functionality of the file app/?page=medicines/manage_medicine. The manipulation of the argument name/description with the input <script>alert('2')</script> leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-223292.Show less
CVE-2023-27059 1Churchcrm 1Churchcrm Jun 17, 2026 Mar 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.
CVE-2023-27494 1Snowflake 1Streamlit Jun 17, 2026 Mar 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vu...Show more Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.Show less
CVE-2023-28106 1Pimcore 1Pimcore Jun 17, 2026 Mar 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5....Show more Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.Show less
CVE-2023-27711 1Typecho 1Typecho Jun 17, 2026 Mar 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component.
CVE-2023-27131 1Typecho 1Typecho Jun 17, 2026 Mar 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code viathe Post Editorparameter.
CVE-2023-27130 1Typecho 1Typecho Jun 17, 2026 Mar 16, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter.
CVE-2021-36821 1Incsub 1Forminator Jun 17, 2026 Mar 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.
CVE-2020-19947 1Markdown Edit Project 1Markdown Edit Jun 17, 2026 Mar 16, 2023 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Cross Site Scripting vulnerability found in Markdown Edit allows a remote attacker to execute arbitrary code via the edit parameter of the webpage.
CVE-2023-1429 1Pimcore 1Pimcore Jun 17, 2026 Mar 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
CVE-2022-41554 1Slideshow Se Project 1Slideshow Se Jun 17, 2026 Mar 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
CVE-2022-40699 1Yasr Yet Another Stars Rating Project 1Yasr Yet Another Stars Rating Jun 17, 2026 Mar 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.
CVE-2022-38971 1Themekraft 1Post Form Registration Form Profile Form For User Profiles And Content Forms Jun 17, 2026 Mar 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
CVE-2023-26951 1Onekeyadmin 1Onekeyadmin Jun 17, 2026 Mar 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
CVE-2023-1421 1Mattermost 1Mattermost Server Jun 17, 2026 Mar 15, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state param...Show more A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.Show less
CVE-2023-26912 1S Mall Ssm Project 1S Mall Ssm Jun 17, 2026 Mar 15, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button.

Previous 1...128112821283...2358 Next