CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 333 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-15726 | Med | 0.42 | 6.4 | 0.00 | Aug 16, 2026 | The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2026-15066 | Med | 0.42 | 6.4 | 0.00 | Aug 16, 2026 | The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2026-11780 | Med | 0.42 | 6.4 | 0.00 | Aug 16, 2026 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This… | ||
| CVE-2026-17090 | Med | 0.42 | 6.4 | 0.00 | Aug 15, 2026 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output… | ||
| CVE-2026-15948 | Med | 0.42 | 6.4 | 0.00 | Aug 15, 2026 | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2026-73357 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | ||
| CVE-2026-73340 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. | ||
| CVE-2026-66687 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. | ||
| CVE-2026-66471 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. | ||
| CVE-2026-66467 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions. | ||
| CVE-2026-66460 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions. | ||
| CVE-2026-66456 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions. | ||
| CVE-2026-28182 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions. | ||
| CVE-2026-27537 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. | ||
| CVE-2026-3639 | Med | 0.42 | 6.4 | 0.00 | Aug 13, 2026 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes.… | ||
| CVE-2026-73415 | Hig | 0.42 | — | 0.01 | Aug 12, 2026 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image… | ||
| CVE-2026-72787 | Med | 0.42 | 6.4 | 0.00 | Aug 12, 2026 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that… | ||
| CVE-2026-49466 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}`… | ||
| CVE-2026-16694 | Med | 0.42 | 6.4 | 0.00 | Aug 12, 2026 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2026-66703 | Med | 0.42 | 6.5 | 0.00 | Aug 6, 2026 | Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. |
- risk 0.42cvss 6.4epss 0.00
The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.42cvss 6.4epss 0.00
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.42cvss 6.4epss 0.00
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This…
- risk 0.42cvss 6.4epss 0.00
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output…
- risk 0.42cvss 6.4epss 0.00
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.42cvss 6.5epss 0.00
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
- risk 0.42cvss 6.5epss 0.00
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
- risk 0.42cvss 6.4epss 0.00
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes.…
- risk 0.42cvss —epss 0.01
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image…
- risk 0.42cvss 6.4epss 0.00
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that…
- risk 0.42cvss 6.5epss 0.00
Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}`…
- risk 0.42cvss 6.4epss 0.00
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.42cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.