Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,365)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-39240 1Mygraph Project 1Mygraph Jun 17, 2026 Sep 24, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.
CVE-2022-38439 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, mali...Show more Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.Show less
CVE-2022-38438 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, mali...Show more Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.Show less
CVE-2022-35251 1Rocketchat 1Rocket.chat Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality...Show more A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets viewed.Show less
CVE-2022-40748 1Ibm 1Infosphere Information Server Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586.Show less
CVE-2022-40359 1Kfm Project 1Kfm Jun 17, 2026 Sep 23, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
CVE-2022-40358 1Ajaxplorer 1Ajaxplorer Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.
CVE-2022-35721 1Ibm 1Jazz For Service Management Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.Show less
CVE-2022-40215 1Tabs Project 1Tabs Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.
CVE-2022-36417 13d Tag Cloud Project 13d Tag Cloud Jun 17, 2026 Sep 23, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.
CVE-2022-40672 1Wpchill 1Cpo Shortcodes Jun 17, 2026 Sep 23, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
CVE-2022-40195 1Loqate 1Loqate Jun 17, 2026 Sep 23, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
CVE-2022-40193 1Brinidesigner 1Awesome Filterable Portfolio Jun 17, 2026 Sep 23, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
CVE-2022-38460 1Notice Board Project 1Notice Board Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.
CVE-2022-37342 1Add Shortcodes Actions And Filters Project 1Add Shortcodes Actions And Filters Jun 17, 2026 Sep 23, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
CVE-2022-37328 1Themesawesome 1Timeline Awesome Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
CVE-2022-36791 1Awesome 1Torro Forms Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.
CVE-2022-40213 1Gsplugins 1Gs Testimonial Slider Jun 17, 2026 Sep 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.
CVE-2022-3144 1Wordfence 1Wordfence Security Jun 17, 2026 Sep 23, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on t...Show more The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.Show less
CVE-2022-38703 1Maxfoundry 1Maxbuttons Jun 17, 2026 Sep 23, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress

Previous 1...137413751376...2369 Next