CWE-79
48,713 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,713)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Draytek 1Vigor2925 Firmware Jun 17, 2026 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product. |
1Draytek 1Vigor2925 Firmware Jun 17, 2026 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product. |
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. |
The wp-piwik plugin before 1.0.5 for WordPress has XSS. |
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. |
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. |
1Websimon Tables Project 1Websimon Tables Nov 21, 2024 Sep 20, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. |
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. |
1Attosoft 1Auto Thickbox Plus Nov 21, 2024 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. |
1Usersultra 1Users Ultra Membership Nov 21, 2024 Sep 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. |
1Usersultra 1Users Ultra Membership Nov 21, 2024 Sep 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. |
1Agentevolution 1Impress Listings Nov 21, 2024 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS. |
1Solaplugins 1Sola Support Tickets Nov 21, 2024 Sep 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. |
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. |
1Plugin Planet 1User Submitted Posts Nov 21, 2024 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. |
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. |
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. |
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. |
1Mtouch Quiz Project 1Mtouch Quiz Nov 21, 2024 Sep 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. |
1Mtouch Quiz Project 1Mtouch Quiz Nov 21, 2024 Sep 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. |