← Back
CWE-79

48,710 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,710)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-9529
2Awesomemotive
Easydigitaldownloads
2Easy Digital Downloads
Stripe
Feb 7, 2025
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS beca...Show more
The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.Show less
CVE-2015-9528
2Awesomemotive
Easydigitaldownloads
2Easy Digital Downloads
Software Licensing
Feb 7, 2025
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7,...Show more
The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.Show less
CVE-2015-9527
2Awesomemotive
Easydigitaldownloads
2Easy Digital Downloads
Simple Shipping
Feb 7, 2025
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has...Show more
The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.Show less
CVE-2015-9526
2Awesomemotive
Easydigitaldownloads
2Easy Digital Downloads
Reviews
Feb 7, 2025
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS bec...Show more
The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.Show less
CVE-2015-9525
2Awesomemotive
Easydigitaldownloads
2Easy Digital Downloads
Recurring Payments
Feb 7, 2025
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7,...Show more
The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.Show less
CVE-2019-16976
1Fusionpbx
1Fusionpbx
Jun 17, 2026
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
CVE-2019-18219
1Sitemagic
1Sitemagic
Jun 17, 2026
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input. The affected components (index.php, upgrade.php) allow for JavaScript injection within both GET or POST r...Show more
Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input. The affected components (index.php, upgrade.php) allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter.Show less
CVE-2019-10475
1Jenkins
1Build Metrics
Jun 17, 2026
Oct 23, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-16973
1Fusionpbx
1Fusionpbx
Jun 17, 2026
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16972
1Fusionpbx
1Fusionpbx
Jun 17, 2026
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16971
1Fusionpbx
1Fusionpbx
Jun 17, 2026
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
CVE-2015-9501
1Artificial Intelligence Project
1Artificial Intelligence
Nov 21, 2024
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
CVE-2019-8089
1Adobe
1Experience Manager Forms
Jun 17, 2026
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-15587
4Canonical
DebianFedoraproject+1 more
4Debian Linux
FedoraLoofah+1 more
Jun 17, 2026
Oct 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
CVE-2015-9500
1Exquisite Ultimate Newspaper Project
1Exquisite Ultimate Newspaper
Nov 21, 2024
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
CVE-2015-9495
1Syndication Links Project
1Syndication Links
Nov 21, 2024
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9494
1Indieweb Post Kinds Project
1Indieweb Post Kinds
Nov 21, 2024
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9493
1Nlb Creationst
1My Wish List
Nov 21, 2024
Oct 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
CVE-2019-17189
1Totemo
1Totemodata
Jun 17, 2026
Oct 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
totemodata 3.0.0_b936 has XSS via a folder name.
CVE-2019-17220
1Rocketchat
1Rocket.chat
Jun 17, 2026
Oct 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.