Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-45115 - - Sep 8, 2026 Aug 18, 2026 N/A· v4 8.7 HIGH· v3 N/A· v2 MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username...Show more MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.Show less
CVE-2026-73426 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 4.6 MEDIUM· v3 N/A· v2 Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer....Show more Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.Show less
CVE-2026-73393 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
CVE-2026-73382 - - Oct 2, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
CVE-2026-73378 - - Oct 23, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73375 - - Oct 23, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73362 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
CVE-2026-73361 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
CVE-2026-73360 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
CVE-2026-73359 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
CVE-2026-73358 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73351 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
CVE-2026-73342 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
CVE-2026-73338 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
CVE-2026-73190 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages:...Show more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.Show less
CVE-2026-68567 - - Oct 28, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Te...Show more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.Show less
CVE-2026-68565 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
CVE-2026-66667 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
CVE-2026-66646 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
CVE-2026-66645 - - Oct 22, 2026 Aug 18, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

Previous 1...136137138...2447 Next