VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,544)

page 145 of 2,428
  • CVE-2026-73182HigAug 19, 2026
    WordPress
    BBQ Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

  • CVE-2026-66596HigAug 19, 2026
    WordPress
    Newsletter
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

  • CVE-2026-61986HigAug 19, 2026
    WordPress
    Contest Gallery
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

  • CVE-2026-19056HigAug 19, 2026
    WordPress
    Prosolution Wp Client
    risk 0.46cvss 7.1epss 0.00

    The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to…

  • CVE-2026-19055HigAug 19, 2026
    WordPress
    Prosolution Wp Client
    risk 0.46cvss 7.1epss 0.00

    The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in…

  • CVE-2026-16570HigAug 19, 2026
    WordPress
    NextScripts: Social Networks Auto-Poster
    risk 0.46cvss 7.1epss 0.00

    The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as…

  • CVE-2026-73393HigAug 18, 2026
    WordPress
    Subscribe2
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

  • CVE-2026-73382HigAug 18, 2026
    Geminilabs
    Site Reviews
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.

  • CVE-2026-73378HigAug 18, 2026
    WordPress
    Contact Form By Supsystic
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

  • CVE-2026-73375HigAug 18, 2026
    WordPress
    Ultimate Maps By Supsystic
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

  • CVE-2026-73362HigAug 18, 2026
    WordPress
    Shorten URL
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

  • CVE-2026-73361HigAug 18, 2026
    WordPress
    Recipe Card Blocks Lite
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

  • CVE-2026-73360HigAug 18, 2026
    WordPress
    Chaty Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

  • CVE-2026-73358HigAug 18, 2026
    WordPress
    Affiliates Manager
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

  • CVE-2026-73351HigAug 18, 2026
    WordPress
    Nextend Social Login and Register
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

  • CVE-2026-73342HigAug 18, 2026
    WordPress
    Wp Multilang
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

  • CVE-2026-73338HigAug 18, 2026
    WordPress
    Autopay
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

  • CVE-2026-73190HigAug 18, 2026
    WordPress
    Wpdm Premium Packages
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.

  • CVE-2026-68567HigAug 18, 2026
    WordPress
    Convert Pro
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.

  • CVE-2026-66667HigAug 18, 2026
    WordPress
    Templately
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.