CWE-79
48,714 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,714)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Woocommerce 1Persian Woocommerce Sms Nov 21, 2024 Sep 17, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. |
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. |
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. |
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. |
1Kentothemes 1Kento Post View Counter Nov 21, 2024 Sep 17, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text. |
1Kentothemes 1Kento Post View Counter Nov 21, 2024 Sep 17, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. |
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. |
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. |
1Tonjoostudio 1Fluid Responsive Slideshow Nov 21, 2024 Sep 17, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. |
OpenEMR v5.0.1-6 allows XSS. |
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads. |
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection. |
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. |
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. |
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS. |
1Supportflow Project 1Supportflow Nov 21, 2024 Sep 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt. |
1Supportflow Project 1Supportflow Nov 21, 2024 Sep 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title. |
1Creativeinteractivemedia 1Real3d Flipbook Nov 21, 2024 Sep 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter. |
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. |
The icegram plugin before 1.9.19 for WordPress has XSS. |