VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 410 of 2,429
  • CVE-2025-5929MedJun 26, 2025
    WordPress
    The Countdown
    risk 0.42cvss 6.4epss 0.00

    The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2025-6538MedJun 26, 2025
    Post Rating and Review
    Post Rating and Review
    risk 0.42cvss 6.4epss 0.00

    The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2025-6383MedJun 26, 2025
    WP-PhotoNav
    WP-PhotoNav
    risk 0.42cvss 6.4epss 0.00

    The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2025-6378MedJun 26, 2025
    Corporatezen
    Responsive Food And Drink Menu
    risk 0.42cvss 6.4epss 0.00

    The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2025-6290MedJun 26, 2025
    WordPress
    Tournament Bracket Generator
    risk 0.42cvss 6.4epss 0.00

    The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2025-6258MedJun 26, 2025
    WordPress
    Wp Soundsystem
    risk 0.42cvss 6.4epss 0.00

    The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-5564MedJun 26, 2025
    WordPress
    Gc Social Wall
    risk 0.42cvss 6.4epss 0.00

    The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-5559MedJun 26, 2025
    WordPress
    TimeZoneCalculator
    risk 0.42cvss 6.4epss 0.00

    The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2025-5540MedJun 26, 2025
    WordPress
    Event RSVP and Simple Event Management Plugin
    risk 0.42cvss 6.4epss 0.00

    The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2025-5535MedJun 26, 2025
    WordPress
    Enigma Buttons
    risk 0.42cvss 6.4epss 0.00

    The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-5488MedJun 26, 2025
    WordPress
    Wp Masonry & Infinite Scroll
    risk 0.42cvss 6.4epss 0.00

    The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-52733MedJun 20, 2025
    WordPress
    Anonform Embedded Secure Form
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embedded-secure-form allows DOM-Based XSS.This issue affects ANON::form embedded secure form: from n/a through <= 1.7.

  • CVE-2025-52707MedJun 20, 2025
    WordPress
    Firelight Lightbox
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.16.

  • CVE-2025-50051MedJun 20, 2025
    WordPress
    Wp Members
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.

  • CVE-2025-50050MedJun 20, 2025
    WordPress
    Jobs for WordPress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.14.

  • CVE-2025-50049MedJun 20, 2025
    Prismtechstudios
    Modern Footnotes
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.

  • CVE-2025-50048MedJun 20, 2025
    WordPress
    Automatically Hierarchic Categories In Menu
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in…

  • CVE-2025-50047MedJun 20, 2025
    WordPress
    Sitekit
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.9.

  • CVE-2025-50046MedJun 20, 2025
    WordPress
    Wpcomplete
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.

  • CVE-2025-50045MedJun 20, 2025
    WordPress
    Related Products Manager for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce related-products-manager-woocommerce allows DOM-Based XSS.This issue affects Related Products Manager for WooCommerce: from…