CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (46,608)
page 116 of 2,331| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66697 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | ||
| CVE-2026-66655 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | ||
| CVE-2026-66468 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. | ||
| CVE-2026-66449 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. | ||
| CVE-2026-66429 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | ||
| CVE-2026-66426 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. | ||
| CVE-2026-65580 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. | ||
| CVE-2026-61974 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. | ||
| CVE-2026-61965 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions. | ||
| CVE-2026-61960 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. | ||
| CVE-2026-28187 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions. | ||
| CVE-2026-28175 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. | ||
| CVE-2026-28170 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions. | ||
| CVE-2026-28158 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. | ||
| CVE-2026-28004 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. | ||
| CVE-2026-28003 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. | ||
| CVE-2026-27539 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | ||
| CVE-2026-27536 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | ||
| CVE-2026-71445 | Hig | 0.46 | — | 0.00 | Aug 6, 2026 | AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker-controlled input… | ||
| CVE-2026-66711 | Hig | 0.46 | 7.1 | 0.00 | Aug 6, 2026 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
- risk 0.46cvss —epss 0.00
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker-controlled input…
- risk 0.46cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.