The simple-membership plugin before 3.5.7 for WordPress has XSS.

The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.

The liveforms plugin before 3.4.0 for WordPress has XSS.

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.

The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.

The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.

Cognitoys Dino devices allow XSS via the SSID.

ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).

cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).

cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).