← Back
CWE-79

49,082 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,082)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-65565
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
CVE-2026-65560
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
CVE-2026-65545
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
CVE-2026-65544
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVE-2026-65517
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
CVE-2026-65515
-
-
Aug 12, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
CVE-2026-65513
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
CVE-2026-65509
-
-
Aug 12, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
CVE-2026-61982
-
-
Aug 12, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
CVE-2026-61964
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
CVE-2026-61963
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
CVE-2026-61961
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
CVE-2026-61959
-
-
Oct 24, 2026
Aug 6, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
CVE-2026-28179
-
-
Oct 23, 2026
Aug 6, 2026
N/A· v4
5.9 MEDIUM· v3
N/A· v2
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
CVE-2026-28178
-
-
Oct 23, 2026
Aug 6, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
CVE-2026-28177
-
-
Oct 26, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.Show less
CVE-2026-28143
-
-
Oct 23, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
CVE-2026-28141
-
-
Oct 23, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
CVE-2026-28082
-
-
Oct 23, 2026
Aug 6, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
CVE-2026-18501
-
-
Aug 12, 2026
Aug 6, 2026
N/A· v4
6.4 MEDIUM· v3
N/A· v2
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versio...Show more
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less