CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 331 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-6128 | Med | 0.42 | 6.4 | 0.00 | Aug 28, 2026 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on… | ||
| CVE-2026-9548 | Med | 0.42 | 6.5 | 0.00 | Aug 28, 2026 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited… | ||
| CVE-2026-82123 | Med | 0.42 | 6.5 | 0.00 | Aug 28, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic. | ||
| CVE-2026-16654 | Med | 0.42 | 6.4 | 0.00 | Aug 28, 2026 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… | ||
| CVE-2026-78273 | Med | 0.42 | 6.5 | 0.00 | Aug 27, 2026 | Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions. | ||
| CVE-2026-47666 | Hig | 0.42 | 7.6 | 0.00 | Aug 26, 2026 | Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without… | ||
| CVE-2026-2388 | Med | 0.42 | 6.4 | 0.00 | Aug 26, 2026 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values… | ||
| CVE-2026-6178 | Med | 0.42 | 6.4 | 0.00 | Aug 26, 2026 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for… | ||
| CVE-2026-18100 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output… | ||
| CVE-2026-12561 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which… | ||
| CVE-2026-76063 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes… | ||
| CVE-2026-19943 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2026-75019 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input… | ||
| CVE-2025-9878 | Med | 0.42 | 6.4 | 0.00 | Aug 25, 2026 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping… | ||
| CVE-2026-78290 | Med | 0.42 | 6.5 | 0.00 | Aug 24, 2026 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions. | ||
| CVE-2026-65644 | Hig | 0.42 | 7.5 | 0.00 | Aug 21, 2026 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via… | ||
| CVE-2026-73402 | Med | 0.42 | 6.5 | 0.00 | Aug 20, 2026 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. | ||
| CVE-2026-66601 | Med | 0.42 | 6.5 | 0.00 | Aug 20, 2026 | Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions. | ||
| CVE-2026-68900 | Hig | 0.42 | 7.6 | 0.00 | Aug 19, 2026 | Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the… | ||
| CVE-2026-15421 | Med | 0.42 | 6.4 | 0.00 | Aug 19, 2026 | The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it… |
- risk 0.42cvss 6.4epss 0.00
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on…
- risk 0.42cvss 6.5epss 0.00
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited…
- risk 0.42cvss 6.5epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.
- risk 0.42cvss 6.4epss 0.00
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
- risk 0.42cvss 7.6epss 0.00
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without…
- risk 0.42cvss 6.4epss 0.00
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values…
- risk 0.42cvss 6.4epss 0.00
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…
- risk 0.42cvss 6.4epss 0.00
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output…
- risk 0.42cvss 6.4epss 0.00
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which…
- risk 0.42cvss 6.4epss 0.00
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes…
- risk 0.42cvss 6.4epss 0.00
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.42cvss 6.4epss 0.00
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input…
- risk 0.42cvss 6.4epss 0.00
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping…
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
- risk 0.42cvss 7.5epss 0.00
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via…
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
- risk 0.42cvss 7.6epss 0.00
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the…
- risk 0.42cvss 6.4epss 0.00
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it…