CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 133 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-62091 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. | ||
| CVE-2026-62082 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. | ||
| CVE-2026-62064 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. | ||
| CVE-2026-62037 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. | ||
| CVE-2026-62034 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. | ||
| CVE-2026-62027 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions. | ||
| CVE-2026-57742 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2. | ||
| CVE-2026-42715 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | ||
| CVE-2026-42711 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | ||
| CVE-2026-42709 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | ||
| CVE-2026-42702 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | ||
| CVE-2026-42697 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through… | ||
| CVE-2026-42693 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | ||
| CVE-2026-42632 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | ||
| CVE-2026-42631 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | ||
| CVE-2026-40803 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | ||
| CVE-2026-39800 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | ||
| CVE-2026-39799 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | ||
| CVE-2026-57806 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through… | ||
| CVE-2026-94160 | Hig | 0.46 | 7.1 | 0.00 | Oct 10, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.