Status Board 1.1.81 has reflected XSS via logic.ts.

The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.

openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

DfE School Experience before v16333-GA has XSS via a teacher training URL.

django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Bolt before 3.6.10 has XSS via an image's alt or title field.

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.

selectize-plugin-a11y before 1.1.0 has XSS via the msg field.

Kimai v2 before 1.1 has XSS via a timesheet description.

Domoticz 4.10717 has XSS via item.Name.

Jooby before 1.6.4 has XSS via the default error handler.

Former before 4.2.1 has XSS via a checkbox value.

CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.

The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.

The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

The corner-ad plugin before 1.0.8 for WordPress has XSS.