CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 141 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-84816 | Hig | 0.46 | 7.1 | 0.00 | Sep 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. | ||
| CVE-2026-81795 | Hig | 0.46 | 7.1 | 0.00 | Sep 10, 2026 | Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. | ||
| CVE-2026-84818 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. | ||
| CVE-2026-84817 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. | ||
| CVE-2026-81798 | Hig | 0.46 | 7.1 | 0.00 | Sep 8, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1. | ||
| CVE-2026-81404 | Hig | 0.46 | 7.1 | 0.00 | Sep 5, 2026 | The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a… | ||
| CVE-2022-35499 | Hig | 0.46 | 7.1 | 0.00 | Sep 4, 2026 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL. | ||
| CVE-2026-84848 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | ||
| CVE-2026-84812 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | ||
| CVE-2026-84765 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | ||
| CVE-2026-84763 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. | ||
| CVE-2026-81776 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | ||
| CVE-2026-81773 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | ||
| CVE-2026-81300 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. | ||
| CVE-2026-81295 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. | ||
| CVE-2026-81292 | Hig | 0.46 | 7.1 | 0.00 | Sep 3, 2026 | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. | ||
| CVE-2026-81775 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. | ||
| CVE-2026-81771 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. | ||
| CVE-2026-81770 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. | ||
| CVE-2026-81289 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.
- risk 0.46cvss 7.1epss 0.00
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a…
- risk 0.46cvss 7.1epss 0.00
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.