The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.

The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.

NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).

cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).

cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).

cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).

cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).

cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).

cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).

cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).

cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).

cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).

cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).