← Back
CWE-79

47,184 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,184)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-3561
1Librenms
1Librenms
Jun 17, 2026
Nov 20, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
CVE-2022-3516
1Librenms
1Librenms
Jun 17, 2026
Nov 20, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
CVE-2022-41938
1Flarum
1Flarum
Jun 17, 2026
Nov 19, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This al...Show more
Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.Show less
CVE-2022-45082
1Oxilab
1Accordions
Jun 17, 2026
Nov 18, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_faqs_license_key.
CVE-2022-41788
1Pencidesign
1Soledad
Jun 17, 2026
Nov 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.
CVE-2022-41643
1Accessibility Project
1Accessibility
Jun 17, 2026
Nov 18, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.
CVE-2022-41615
1Agilelogix
1Store Locator
Jun 17, 2026
Nov 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
CVE-2022-40963
1Themeum
1Wp Page Builder
Jun 17, 2026
Nov 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.
CVE-2022-40698
1Expresstech
1Quiz And Survey Master
Jun 17, 2026
Nov 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
CVE-2021-37936
1Elastic
1Kibana
Jun 17, 2026
Nov 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the D...Show more
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.Show less
CVE-2021-31739
1Seppmail
1Seppmail
Jun 17, 2026
Nov 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient ad...Show more
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.Show less
CVE-2022-43463
1Yikesinc
1Custom Product Tabs For Woocommerce
Jun 17, 2026
Nov 18, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.
CVE-2022-38075
1Webartesanal
1Mantenimiento Web
Jun 17, 2026
Nov 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
CVE-2022-45375
1Cyberchimps
1Ifeature Slider
Jun 17, 2026
Nov 17, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress.
CVE-2022-44736
1Chameleon Project
1Chameleon
Jun 17, 2026
Nov 17, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.
CVE-2022-44591
1Anthologize Project
1Anthologize
Jun 17, 2026
Nov 17, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress.
CVE-2022-43332
1Wondercms
1Wondercms
Jun 17, 2026
Nov 17, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel.
CVE-2022-41315
1Ezoic
1Ezoic
Jun 17, 2026
Nov 17, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
CVE-2022-41132
1Ezoic
1Ezoic
Jun 17, 2026
Nov 17, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
CVE-2022-40694
1Storeapps
1News Announcement Scroll
Jun 17, 2026
Nov 17, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.