VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 144 of 2,428
  • CVE-2026-49825HigAug 20, 2026
    Lxml
    Lxml
    risk 0.46cvss 8.2epss 0.00

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml…

  • CVE-2026-68564HigAug 20, 2026
    WordPress
    NotificationX Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

  • CVE-2026-66673HigAug 20, 2026
    WordPress
    Flatastic
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

  • CVE-2026-66616HigAug 20, 2026
    WordPress
    Form Maker by 10Web
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.

  • CVE-2026-66614HigAug 20, 2026
    WordPress
    Seo Plugin By Squirrly Seo
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

  • CVE-2026-66612HigAug 20, 2026
    WordPress
    Aora
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

  • CVE-2026-66611HigAug 20, 2026
    WordPress
    Paymob for WooCommerce
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

  • CVE-2026-66607HigAug 20, 2026
    WordPress
    Advance Product Search
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

  • CVE-2026-66606HigAug 20, 2026
    WordPress
    SmartSMTP
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

  • CVE-2026-66605HigAug 20, 2026
    WordPress
    Swatchly
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

  • CVE-2026-66598HigAug 20, 2026
    WordPress
    B2BKing Premium
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

  • CVE-2026-66597HigAug 20, 2026
    WordPress
    Wpdatatables
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

  • CVE-2026-66590HigAug 20, 2026
    WordPress
    Tagembed Widget
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

  • CVE-2026-66582HigAug 20, 2026
    WordPress
    TranslatePress
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

  • CVE-2026-66581HigAug 20, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

  • CVE-2026-76333HigAug 19, 2026
    Splunk
    Splunk
    risk 0.46cvss 7.1epss 0.00

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event…

  • CVE-2026-73354HigAug 19, 2026
    WordPress
    SimplyRETS Real Estate IDX
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

  • CVE-2026-73184HigAug 19, 2026
    WordPress
    Global Gallery
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

  • CVE-2026-73182HigAug 19, 2026
    WordPress
    BBQ Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

  • CVE-2026-66596HigAug 19, 2026
    WordPress
    Newsletter
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.