CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 142 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-81288 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. | ||
| CVE-2026-82883 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1. | ||
| CVE-2026-19723 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a… | ||
| CVE-2026-12865 | Hig | 0.46 | 7.1 | 0.00 | Sep 2, 2026 | The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a… | ||
| CVE-2026-84370 | Hig | 0.46 | 8.2 | 0.01 | Sep 1, 2026 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable… | ||
| CVE-2026-84189 | Hig | 0.46 | 8.1 | 0.00 | Sep 1, 2026 | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at… | ||
| CVE-2026-82229 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions. | ||
| CVE-2026-82224 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. | ||
| CVE-2026-82221 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions. | ||
| CVE-2026-81768 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||
| CVE-2026-81765 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||
| CVE-2026-81764 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions. | ||
| CVE-2026-81298 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions. | ||
| CVE-2026-81291 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions. | ||
| CVE-2026-81290 | Hig | 0.46 | 7.1 | 0.00 | Aug 31, 2026 | Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions. | ||
| CVE-2026-14307 | Hig | 0.46 | 7.1 | 0.00 | Aug 30, 2026 | The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a… | ||
| CVE-2026-81760 | Hig | 0.46 | 7.1 | 0.00 | Aug 28, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2. | ||
| CVE-2026-78293 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. | ||
| CVE-2026-78289 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions. | ||
| CVE-2026-78283 | Hig | 0.46 | 7.1 | 0.00 | Aug 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.
- risk 0.46cvss 7.1epss 0.00
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a…
- risk 0.46cvss 7.1epss 0.00
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a…
- risk 0.46cvss 8.2epss 0.01
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable…
- risk 0.46cvss 8.1epss 0.00
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
- risk 0.46cvss 7.1epss 0.00
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.