VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,567)

page 1269 of 2,429
  • CVE-2024-13289MedJan 9, 2025
    Drupal
    Cookiebot + GTM
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

  • CVE-2024-42898MedJan 9, 2025
    Nagios
    XI
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.

  • CVE-2024-13287MedJan 9, 2025
    Drupal
    Views SVG Animation
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

  • CVE-2024-13286MedJan 9, 2025
    Drupal
    SVG Embed
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

  • CVE-2024-13273MedJan 9, 2025
    Drupal
    Open Social
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11.

  • CVE-2024-13252MedJan 9, 2025
    Drupal
    TacJS
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.

  • CVE-2024-13245MedJan 9, 2025
    Drupal
    CKEditor 4 LTS - WYSIWYG HTML editor
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1.

  • CVE-2024-13238MedJan 9, 2025
    Drupal
    Typogrify
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.

  • CVE-2024-13237MedJan 9, 2025
    Drupal
    File Entity
    risk 0.35cvss 5.4epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.

  • CVE-2024-13153MedJan 9, 2025
    Unlimited Elements
    Unlimited Elements For Elementor
    risk 0.35cvss 6.4epss 0.00

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-12852MedJan 8, 2025
    WordPress
    Happy Addons For Elementor
    risk 0.35cvss 6.4epss 0.00

    The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it…

  • CVE-2024-10151MedJan 8, 2025
    WordPress
    Auto Iframe
    risk 0.35cvss 5.4epss 0.00

    The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting…

  • CVE-2024-12112MedJan 8, 2025
    WordPress
    Easy Form Builder
    risk 0.35cvss 6.4epss 0.00

    The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and…

  • CVE-2024-11826MedJan 7, 2025
    WordPress
    Quill Forms
    risk 0.35cvss 6.4epss 0.00

    The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up…

  • CVE-2024-12624MedJan 7, 2025
    WordPress
    Sina Extension For Elementor
    risk 0.35cvss 6.4epss 0.00

    The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-9702MedJan 7, 2025
    Social Rocket
    Social Rocket
    risk 0.35cvss 6.4epss 0.00

    The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user…

  • CVE-2024-11887MedJan 7, 2025
    WordPress
    Geo Content
    risk 0.35cvss 6.4epss 0.00

    The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11756MedJan 7, 2025
    WordPress
    SweepWidget Contests, Giveaways, Photo Contests, Competitions
    risk 0.35cvss 6.4epss 0.00

    The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on…

  • CVE-2024-12462MedJan 7, 2025
    WordPress
    YOGO Booking
    risk 0.35cvss 6.4epss 0.00

    The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-12590MedJan 7, 2025
    WordPress
    Wp Youtube Gallery
    risk 0.35cvss 6.4epss 0.00

    The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…