CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (46,608)
page 114 of 2,331| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66598 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. | ||
| CVE-2026-66597 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions. | ||
| CVE-2026-66590 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. | ||
| CVE-2026-66582 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. | ||
| CVE-2026-66581 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. | ||
| CVE-2026-76333 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event… | ||
| CVE-2026-73354 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions. | ||
| CVE-2026-73184 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions. | ||
| CVE-2026-73182 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions. | ||
| CVE-2026-66596 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions. | ||
| CVE-2026-61986 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions. | ||
| CVE-2026-19056 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to… | ||
| CVE-2026-19055 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in… | ||
| CVE-2026-16570 | Hig | 0.46 | 7.1 | 0.00 | Aug 19, 2026 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as… | ||
| CVE-2026-73393 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. | ||
| CVE-2026-73382 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions. | ||
| CVE-2026-73378 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. | ||
| CVE-2026-73375 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | ||
| CVE-2026-73362 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions. | ||
| CVE-2026-73361 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
- risk 0.46cvss 7.1epss 0.00
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
- risk 0.46cvss 7.1epss 0.00
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to…
- risk 0.46cvss 7.1epss 0.00
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in…
- risk 0.46cvss 7.1epss 0.00
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.