VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,544)

page 148 of 2,428
  • CVE-2026-65565HigAug 6, 2026
    WordPress
    Survey Maker
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

  • CVE-2026-65560HigAug 6, 2026
    WordPress
    Houzez Property Feed
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

  • CVE-2026-65545HigAug 6, 2026
    WordPress
    AI Engine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  • CVE-2026-65544HigAug 6, 2026
    WordPress
    Super Socializer
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  • CVE-2026-65517HigAug 6, 2026
    WordPress
    Easy Paypal Buy Now Button
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  • CVE-2026-65515HigAug 6, 2026
    WordPress
    Affiliatewp
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  • CVE-2026-65513HigAug 6, 2026
    WordPress
    Simply Schedule Appointments
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  • CVE-2026-65509HigAug 6, 2026
    WordPress
    Wpdatatables
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  • CVE-2026-61982HigAug 6, 2026
    WordPress
    SiteGuard WP Plugin
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

  • CVE-2026-61964HigAug 6, 2026
    WordPress
    Ninja Tables
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

  • CVE-2026-61963HigAug 6, 2026
    WordPress
    Media Library Assistant
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

  • CVE-2026-61961HigAug 6, 2026
    WordPress
    Embedpress
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

  • CVE-2026-28177HigAug 6, 2026
    WordPress
    Popup Maker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

  • CVE-2026-28143HigAug 6, 2026
    WordPress
    Forminator
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  • CVE-2026-28141HigAug 6, 2026
    WordPress
    Nextgen Gallery
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  • CVE-2026-28082HigAug 6, 2026
    WordPress
    Jetengine
    risk 0.46cvss 7.1epss 0.00

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  • CVE-2026-70486HigAug 4, 2026
    Openwebui
    Open Webui
    risk 0.46cvss 8.2epss 0.00

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any…

  • CVE-2026-67328HigAug 1, 2026
    Better Auth
    Better Auth
    risk 0.46cvss 8.1epss 0.00

    @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML…

  • CVE-2026-13725HigAug 1, 2026
    WordPress
    Dynamic Pricing and Discount Rules for WooCommerce
    risk 0.46cvss 7.1epss 0.00

    The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site…

  • CVE-2026-56672HigJul 31, 2026
    Comfy Org
    ComfyUI
    risk 0.46cvss 8.2epss 0.00

    ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API…