CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,544)
page 146 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66633 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. | ||
| CVE-2026-66629 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions. | ||
| CVE-2026-66621 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2. | ||
| CVE-2026-32547 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions. | ||
| CVE-2026-32333 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions. | ||
| CVE-2026-28569 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. | ||
| CVE-2026-28568 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions. | ||
| CVE-2026-33437 | Hig | 0.46 | 8.1 | 0.00 | Aug 17, 2026 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text… | ||
| CVE-2026-73650 | Hig | 0.46 | 8.2 | 0.00 | Aug 13, 2026 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in… | ||
| CVE-2026-28154 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex -… | ||
| CVE-2026-66700 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. | ||
| CVE-2026-66698 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. | ||
| CVE-2026-66697 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | ||
| CVE-2026-66655 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | ||
| CVE-2026-66468 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. | ||
| CVE-2026-66449 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. | ||
| CVE-2026-66429 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | ||
| CVE-2026-66426 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. | ||
| CVE-2026-65580 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. | ||
| CVE-2026-61974 | Hig | 0.46 | 7.1 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
- risk 0.46cvss 8.1epss 0.00
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text…
- risk 0.46cvss 8.2epss 0.00
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in…
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex -…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.