Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,723)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-10897 1Sermon Browser Project 1Sermon Browser Nov 21, 2024 Aug 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
CVE-2016-10896 1Clogica 1Seo Redirection Nov 21, 2024 Aug 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The seo-redirection plugin before 4.3 for WordPress has stored XSS.
CVE-2015-9321 1Wpmadeeasy 1Shortcode Factory Nov 21, 2024 Aug 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
CVE-2019-4482 1Ibm 1Emptoris Spend Analysis Jun 17, 2026 Aug 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...Show more IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164066.Show less
CVE-2019-4120 1Ibm 1Cloud Private Jun 17, 2026 Aug 20, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cr...Show more IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158146.Show less
CVE-2019-3966 1Open Emr 1Openemr Jun 17, 2026 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2019-3965 1Open Emr 1Openemr Jun 17, 2026 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2019-3964 1Open Emr 1Openemr Jun 17, 2026 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2019-3963 1Open Emr 1Openemr Jun 17, 2026 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2018-20978 1Soflyy 1Wp All Import Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-all-import plugin before 3.4.7 for WordPress has XSS.
CVE-2017-18566 1Bestwebsoft 1User Role Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
CVE-2017-18533 1Rimons Twitter Widget Project 1Rimons Twitter Widget Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
CVE-2017-18532 1Bestwebsoft 1Realty Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2017-18531 1Raygun 1Raygun4wp Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
CVE-2017-18530 1Bestwebsoft 1Rating Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVE-2017-18529 1Bestwebsoft 1Promobar Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
CVE-2017-18528 1Bestwebsoft 1Pdf & Print Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
CVE-2017-18527 1Bestwebsoft 1Pagination Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
CVE-2017-18526 1Lamp Solutions 1Moreads Se Nov 21, 2024 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The moreads-se plugin before 1.4.7 for WordPress has XSS.
CVE-2017-18524 1Antoineh 1Football Pool Jul 16, 2025 Aug 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.

Previous 1...185218531854...2437 Next