Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,952)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-19744 - - Sep 1, 2026 Aug 13, 2026 5.1 MEDIUM· v4 N/A· v3 N/A· v2 Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote,...Show more Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotesShow less
CVE-2026-28154 - - Aug 14, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress T...Show more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.Show less
CVE-2026-73357 - - Oct 23, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2026-73344 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
CVE-2026-73340 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
CVE-2026-66700 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
CVE-2026-66698 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
CVE-2026-66697 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
CVE-2026-66687 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
CVE-2026-66655 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
CVE-2026-66471 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
CVE-2026-66468 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
CVE-2026-66467 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
CVE-2026-66460 - - Aug 14, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
CVE-2026-66456 - - Aug 14, 2026 Aug 13, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
CVE-2026-66449 - - Aug 14, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
CVE-2026-66429 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
CVE-2026-66426 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
CVE-2026-65580 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
CVE-2026-61974 - - Oct 24, 2026 Aug 13, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

Previous 1...143144145...2448 Next