← Back
CWE-79

45,542 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (45,542)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-40791
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.
CVE-2026-40787
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
CVE-2026-40770
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.
CVE-2026-40732
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.
CVE-2026-39540
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
CVE-2026-39514
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
CVE-2026-39507
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
CVE-2026-39491
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
CVE-2026-39463
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.
CVE-2026-39451
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
6.3 MEDIUM· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
CVE-2026-39449
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.
CVE-2026-39447
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
CVE-2026-39435
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.
CVE-2026-34902
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.
CVE-2026-34900
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
CVE-2026-23970
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
CVE-2025-68872
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics <= 1.3.03.27 versions.
CVE-2025-68851
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
CVE-2025-68840
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
CVE-2026-50883
-
-
Jun 17, 2026
Jun 15, 2026
N/A· v4
9.6 CRITICAL· v3
N/A· v2
An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.