← Back
CWE-79

48,721 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,721)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-18575
1Newstatpress Project
1Newstatpress
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
CVE-2017-18572
1Sir
1Gnucommerce
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
CVE-2016-10920
1Sir
1Gnucommerce
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
CVE-2016-10919
1Wassup Real Time Analytics Project
1Wassup Real Time Analytics
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
CVE-2015-9336
1Codection
1Clean Login
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
CVE-2013-7481
1Bestwebsoft
1Contact Form
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
CVE-2013-7480
1Pixelite
1Events Manager
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
CVE-2013-7479
1Pixelite
1Events Manager
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
CVE-2013-7478
1Pixelite
1Events Manager
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
CVE-2013-7477
1Pixelite
1Events Manager
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
CVE-2012-6716
1Pixelite
1Events Manager
Nov 21, 2024
Aug 22, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
CVE-2019-13476
1Control Webpanel
1Webpanel
Jun 17, 2026
Aug 21, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
CVE-2019-15127
1Vanderbilt
1Redcap
Jun 17, 2026
Aug 21, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
CVE-2019-15074
1Mantisbt
1Mantisbt
Jun 17, 2026
Aug 21, 2019
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment wi...Show more
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.Show less
CVE-2019-12626
1Cisco
1Unified Contact Center Express
Jun 17, 2026
Aug 21, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a us...Show more
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs valid administrator credentials.Show less
CVE-2018-20977
1Brainstormforce
1Schema
Jun 27, 2025
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
CVE-2018-20970
1Bestwebsoft
1Pdf & Print
Nov 21, 2024
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
CVE-2017-18562
1Bestwebsoft
1Error Log Viewer
Nov 21, 2024
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
CVE-2017-18561
1Embed Images In Comments Project
1Embed Images In Comments
Nov 21, 2024
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The embed-comment-images plugin before 0.6 for WordPress has XSS.
CVE-2017-18559
1Cformsii Project
1Cformsii
Nov 21, 2024
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.