VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 400 of 2,429
  • CVE-2025-58194MedAug 27, 2025
    WordPress
    Bold Page Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.3.

  • CVE-2025-9277MedAug 26, 2025
    WordPress
    Siteseo
    risk 0.42cvss 6.4epss 0.00

    The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2025-8062MedAug 23, 2025
    WordPress
    Ws Theme Addons
    risk 0.42cvss 6.4epss 0.00

    The WS Theme Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ws_weather shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-7957MedAug 23, 2025
    WordPress
    Shortcodehub
    risk 0.42cvss 6.4epss 0.00

    The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2025-57887MedAug 22, 2025
    WordPress
    Noo Jobmonster
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This issue affects Jobmonster: from n/a through <= 4.8.0.

  • CVE-2025-55522MedAug 21, 2025
    Akaunting
    Akaunting
    risk 0.42cvss 6.5epss 0.00

    Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

  • CVE-2025-8607MedAug 21, 2025
    WordPress
    Slingblocks
    risk 0.42cvss 6.4epss 0.00

    The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output…

  • CVE-2025-54046MedAug 20, 2025
    WordPress
    Cost Calculator
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.

  • CVE-2025-53195MedAug 20, 2025
    WordPress
    Jetengine
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.

  • CVE-2025-49397MedAug 20, 2025
    WordPress
    Colorbox Lightbox
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.

  • CVE-2025-49395MedAug 20, 2025
    WordPress
    Themify Icons
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through <= 2.0.3.

  • CVE-2025-49389MedAug 20, 2025
    WordPress
    Notice Bar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.

  • CVE-2025-7496MedAug 19, 2025
    WordPress
    WPC Smart Compare for WooCommerce
    risk 0.42cvss 6.4epss 0.00

    The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2025-8143MedAug 16, 2025
    WordPress
    Soledad
    risk 0.42cvss 6.4epss 0.00

    The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2025-8719MedAug 16, 2025
    WordPress
    Translate This gTranslate Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2025-8896MedAug 16, 2025
    WordPress
    Profile Builder
    risk 0.42cvss 6.4epss 0.00

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to…

  • CVE-2025-8293MedAug 16, 2025
    WordPress
    Intl Datetime Calendar
    risk 0.42cvss 6.4epss 0.00

    The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2025-7651MedAug 16, 2025
    WordPress
    Earnware Connect
    risk 0.42cvss 6.4epss 0.00

    The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ew_hasrole' shortcode in all versions up to, and including, 1.0.74 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-7649MedAug 16, 2025
    WordPress
    Surbma Recent Comments Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'recent-comments' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2025-7440MedAug 16, 2025
    WordPress
    Anber Elementor Addon
    risk 0.42cvss 6.4epss 0.00

    The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item['button_link']['url'] parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated…