CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,561)
page 325 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-97298 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | ||
| CVE-2026-97292 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | ||
| CVE-2026-97288 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. | ||
| CVE-2026-97286 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11. | ||
| CVE-2026-97279 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. | ||
| CVE-2026-97270 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | ||
| CVE-2026-97266 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | ||
| CVE-2026-97262 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | ||
| CVE-2026-97236 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||
| CVE-2026-97067 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. | ||
| CVE-2026-96835 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions. | ||
| CVE-2026-96829 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions. | ||
| CVE-2026-96338 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. | ||
| CVE-2026-94674 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions. | ||
| CVE-2026-62080 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions. | ||
| CVE-2026-62079 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions. | ||
| CVE-2026-62078 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | ||
| CVE-2026-102386 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. | ||
| CVE-2026-100513 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. | ||
| CVE-2026-92712 | Med | 0.42 | 6.4 | 0.00 | Sep 30, 2026 | The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for… |
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
- risk 0.42cvss 6.5epss 0.00
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
- risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
- risk 0.42cvss 6.4epss 0.00
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for…