The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.

In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.

Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.

In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.

Recommender before 2018-07-18 allows XSS.

studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.

The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.

The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.