← Back
CWE-79

48,721 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,721)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-20986
1Advancedcustomfields
1Advanced Custom Fields
Nov 21, 2024
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
CVE-2017-18579
1Dwbooster
1Corner Ad
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The corner-ad plugin before 1.0.8 for WordPress has XSS.
CVE-2017-18578
1Crafty Social Buttons Project
1Crafty Social Buttons
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
CVE-2014-10393
1Cformsii Project
1Cformsii
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The cforms2 plugin before 10.5 for WordPress has XSS.
CVE-2019-15331
1Wpsupportplus
1Wp Support Plus Responsive Ticket System
Jun 17, 2026
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
CVE-2019-12386
1Ampache
1Ampache
Jun 17, 2026
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to...Show more
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.Show less
CVE-2014-10392
1Cformsii Project
1Cformsii
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The cforms2 plugin before 10.2 for WordPress has XSS.
CVE-2019-14469
1Sonatype
1Nexus Repository Manager
Jun 17, 2026
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
CVE-2018-20983
1Meowapps
1Wp Retina 2x
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
CVE-2017-18582
1Time Sheets Project
1Time Sheets
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
CVE-2017-18581
1Time Sheets Project
1Time Sheets
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
CVE-2017-18577
1Ibericode
1Mailchimp For Wordpress
Jan 27, 2026
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
CVE-2017-18576
1Event Notifier Project
1Event Notifier
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
CVE-2016-10925
1Profilepress
1Loginwp
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
CVE-2014-10385
1Memphis Documents Library Project
1Memphis Documents Library
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
CVE-2013-7482
1Reflex Gallery Project
1Reflex Gallery
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
CVE-2008-7321
1Tubepress
1Tubepress
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The tubepress plugin before 1.6.5 for WordPress has XSS.
CVE-2019-15317
1Givewp
1Givewp
Jun 17, 2026
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
CVE-2019-15314
1Tiki
1Tikiwiki Cms/groupware
Jun 17, 2026
Aug 22, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
CVE-2018-20982
1Davidlingren
1Media Library Assistant
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.