CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 138 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-92412 | Hig | 0.46 | 7.1 | 0.00 | Oct 1, 2026 | The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a… | ||
| CVE-2026-97290 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions. | ||
| CVE-2026-94171 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18. | ||
| CVE-2026-102391 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. | ||
| CVE-2026-102376 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions. | ||
| CVE-2026-100510 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions. | ||
| CVE-2026-97289 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6. | ||
| CVE-2026-97272 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. | ||
| CVE-2026-97271 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | ||
| CVE-2026-97253 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | ||
| CVE-2026-97250 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. | ||
| CVE-2026-97237 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3. | ||
| CVE-2026-97235 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||
| CVE-2026-97077 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. | ||
| CVE-2026-97065 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. | ||
| CVE-2026-96836 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. | ||
| CVE-2026-96830 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. | ||
| CVE-2026-96820 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. | ||
| CVE-2026-96819 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. | ||
| CVE-2026-96816 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions. |
- risk 0.46cvss 7.1epss 0.00
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
- risk 0.46cvss 7.1epss 0.00
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.