VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,608)

page 115 of 2,331
  • CVE-2026-73360HigAug 18, 2026
    WordPress
    Chaty Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

  • CVE-2026-73358HigAug 18, 2026
    WordPress
    Affiliates Manager
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

  • CVE-2026-73351HigAug 18, 2026
    WordPress
    Nextend Social Login and Register
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

  • CVE-2026-73342HigAug 18, 2026
    WordPress
    Wp Multilang
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

  • CVE-2026-73338HigAug 18, 2026
    WordPress
    Autopay
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

  • CVE-2026-73190HigAug 18, 2026
    WordPress
    Wpdm Premium Packages
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.

  • CVE-2026-68567HigAug 18, 2026
    WordPress
    Convert Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.

  • CVE-2026-66667HigAug 18, 2026
    WordPress
    Templately
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

  • CVE-2026-66633HigAug 18, 2026
    WordPress
    Fluent Forms Pro Add On Pack
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

  • CVE-2026-66629HigAug 18, 2026
    WordPress
    Kirki
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

  • CVE-2026-66621HigAug 18, 2026
    WordPress
    Ultimate Dashboard
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

  • CVE-2026-32547HigAug 18, 2026
    WordPress
    Bp Better Messages
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

  • CVE-2026-32333HigAug 18, 2026
    WordPress
    Mayosis Core
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

  • CVE-2026-28569HigAug 18, 2026
    WordPress
    SSL Zen
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

  • CVE-2026-28568HigAug 18, 2026
    WordPress
    Quill Forms
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

  • CVE-2026-33437HigAug 17, 2026
    Stirlingpdf
    Stirling PDF
    risk 0.46cvss 8.1epss 0.00

    Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text…

  • CVE-2026-73650HigAug 13, 2026
    Svgo
    Svgo
    risk 0.46cvss 8.2epss 0.00

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in…

  • CVE-2026-28154HigAug 13, 2026
    WordPress
    Samex - Clean, Minimal Shop WooCommerce WordPress Theme
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex -…

  • CVE-2026-66700HigAug 13, 2026
    WordPress
    Smart Online Order For Clover
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

  • CVE-2026-66698HigAug 13, 2026
    WordPress
    SureDash
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.