CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,561)
page 328 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66579 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. | ||
| CVE-2026-66577 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. | ||
| CVE-2026-66576 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions. | ||
| CVE-2026-66574 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. | ||
| CVE-2026-66573 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. | ||
| CVE-2026-66572 | Med | 0.42 | 6.5 | 0.00 | Sep 17, 2026 | Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. | ||
| CVE-2026-11996 | Med | 0.42 | 6.4 | 0.00 | Sep 16, 2026 | The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,… | ||
| CVE-2026-81898 | Hig | 0.42 | — | 0.00 | Sep 15, 2026 | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the… | ||
| CVE-2026-12750 | Med | 0.42 | 6.4 | 0.00 | Sep 15, 2026 | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2026-12749 | Med | 0.42 | 6.4 | 0.00 | Sep 15, 2026 | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2026-55692 | Hig | 0.42 | 7.5 | 0.00 | Sep 15, 2026 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,… | ||
| CVE-2026-55690 | Hig | 0.42 | 7.5 | 0.00 | Sep 15, 2026 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php… | ||
| CVE-2026-88618 | Med | 0.42 | 6.5 | 0.00 | Sep 15, 2026 | 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code. | ||
| CVE-2026-15609 | Med | 0.42 | 6.4 | 0.00 | Sep 15, 2026 | The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2026-18063 | Med | 0.42 | 6.4 | 0.00 | Sep 15, 2026 | The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2026-15402 | Med | 0.42 | 6.4 | 0.00 | Sep 15, 2026 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input… | ||
| CVE-2026-54087 | Hig | 0.42 | 7.6 | 0.00 | Sep 14, 2026 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download… | ||
| CVE-2026-90772 | Hig | 0.42 | 7.6 | 0.00 | Sep 13, 2026 | Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the… | ||
| CVE-2026-62138 | Med | 0.42 | 6.5 | 0.00 | Sep 11, 2026 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. | ||
| CVE-2026-62111 | Med | 0.42 | 6.5 | 0.00 | Sep 11, 2026 | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
- risk 0.42cvss 6.4epss 0.00
The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
- risk 0.42cvss —epss 0.00
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the…
- risk 0.42cvss 6.4epss 0.00
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.42cvss 6.4epss 0.00
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.42cvss 7.5epss 0.00
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,…
- risk 0.42cvss 7.5epss 0.00
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php…
- risk 0.42cvss 6.5epss 0.00
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.
- risk 0.42cvss 6.4epss 0.00
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.42cvss 6.4epss 0.00
The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.42cvss 6.4epss 0.00
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input…
- risk 0.42cvss 7.6epss 0.00
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download…
- risk 0.42cvss 7.6epss 0.00
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the…
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.