CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,561)
page 326 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-14564 | Med | 0.42 | 6.4 | 0.00 | Sep 30, 2026 | The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2026-92232 | Med | 0.42 | 6.5 | 0.00 | Sep 29, 2026 | Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing… | ||
| CVE-2026-90914 | Med | 0.42 | 6.4 | 0.00 | Sep 29, 2026 | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts. | ||
| CVE-2026-15273 | Med | 0.42 | 6.4 | 0.00 | Sep 26, 2026 | The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will… | ||
| CVE-2026-53610 | Hig | 0.42 | — | 0.00 | Sep 25, 2026 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in… | ||
| CVE-2026-93747 | Med | 0.42 | 6.4 | 0.00 | Sep 25, 2026 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data']… | ||
| CVE-2026-13179 | Med | 0.42 | 6.4 | 0.00 | Sep 25, 2026 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output… | ||
| CVE-2026-94376 | Med | 0.42 | 6.4 | 0.00 | Sep 25, 2026 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output… | ||
| CVE-2026-57440 | Hig | 0.42 | 7.5 | 0.00 | Sep 24, 2026 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are… | ||
| CVE-2026-95586 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | ||
| CVE-2026-95530 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | ||
| CVE-2026-94682 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | ||
| CVE-2026-94680 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | ||
| CVE-2026-94671 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | ||
| CVE-2026-94500 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | ||
| CVE-2026-94461 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | ||
| CVE-2026-94391 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | ||
| CVE-2026-94168 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | ||
| CVE-2026-94118 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | ||
| CVE-2026-93772 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
- risk 0.42cvss 6.4epss 0.00
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.42cvss 6.5epss 0.00
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing…
- risk 0.42cvss 6.4epss 0.00
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.
- risk 0.42cvss 6.4epss 0.00
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will…
- risk 0.42cvss —epss 0.00
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in…
- risk 0.42cvss 6.4epss 0.00
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data']…
- risk 0.42cvss 6.4epss 0.00
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output…
- risk 0.42cvss 6.4epss 0.00
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output…
- risk 0.42cvss 7.5epss 0.00
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are…
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.