CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 137 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-32569 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. | ||
| CVE-2026-105061 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | ||
| CVE-2026-104814 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | ||
| CVE-2026-104672 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | ||
| CVE-2026-104670 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | ||
| CVE-2026-104395 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. | ||
| CVE-2026-104394 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. | ||
| CVE-2026-103346 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1. | ||
| CVE-2026-39760 | Hig | 0.46 | 7.1 | 0.00 | Oct 6, 2026 | Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. | ||
| CVE-2026-105650 | Hig | 0.46 | 8.1 | 0.00 | Oct 5, 2026 | Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter… | ||
| CVE-2026-100515 | Hig | 0.46 | 7.1 | 0.00 | Oct 5, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30. | ||
| CVE-2025-15643 | Hig | 0.46 | 7.1 | 0.00 | Oct 5, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4. | ||
| CVE-2026-103354 | Hig | 0.46 | 7.1 | 0.00 | Oct 4, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1. | ||
| CVE-2026-103062 | Hig | 0.46 | 7.1 | 0.00 | Oct 4, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6. | ||
| CVE-2026-104414 | Hig | 0.46 | 8.1 | 0.00 | Oct 2, 2026 | Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that… | ||
| CVE-2026-97273 | Hig | 0.46 | 7.1 | 0.00 | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | ||
| CVE-2026-97268 | Hig | 0.46 | 7.1 | 0.00 | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | ||
| CVE-2026-97260 | Hig | 0.46 | 7.1 | 0.00 | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. | ||
| CVE-2026-102378 | Hig | 0.46 | 7.1 | 0.00 | Oct 1, 2026 | Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions. | ||
| CVE-2026-103277 | Hig | 0.46 | 8.1 | 0.00 | Oct 1, 2026 | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin… |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
- risk 0.46cvss 8.1epss 0.00
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
- risk 0.46cvss 8.1epss 0.00
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
- risk 0.46cvss 8.1epss 0.00
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin…