VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 446 of 2,429
  • CVE-2025-0506MedFeb 12, 2025
    WordPress
    Rise Blocks
    risk 0.42cvss 6.4epss 0.00

    The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag parameter in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-13459MedFeb 12, 2025
    WordPress
    Fusedesk
    risk 0.42cvss 6.4epss 0.00

    The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-13456MedFeb 12, 2025
    WordPress
    Easy Quiz Maker
    risk 0.42cvss 6.4epss 0.00

    The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-13769MedFeb 12, 2025
    WordPress
    Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
    risk 0.42cvss 6.4epss 0.00

    The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.2.4. This makes it…

  • CVE-2024-13665MedFeb 12, 2025
    WordPress
    Admire Extra
    risk 0.42cvss 6.4epss 0.00

    The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-13658MedFeb 12, 2025
    WordPress
    Ngg Smart Image Search
    risk 0.42cvss 6.4epss 0.00

    The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2024-11746MedFeb 12, 2025
    WordPress
    Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin
    risk 0.42cvss 6.4epss 0.00

    The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input…

  • CVE-2024-13701MedFeb 12, 2025
    Stklcode
    Liveticker
    risk 0.42cvss 6.4epss 0.00

    The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2025-0169MedFeb 8, 2025
    WordPress
    Dwt Directory And Listing Wordpress Theme
    risk 0.42cvss 6.4epss 0.00

    The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…

  • CVE-2025-25136MedFeb 7, 2025
    WordPress
    Optimate Ads
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through <= 1.0.3.

  • CVE-2025-25117MedFeb 7, 2025
    WordPress
    Smart Countdown Fx
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through <= 1.5.5.

  • CVE-2025-25098MedFeb 7, 2025
    WordPress
    Links In Captions
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through <= 1.2.

  • CVE-2025-25097MedFeb 7, 2025
    WordPress
    External Video For Everybody
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for-everybody allows Stored XSS.This issue affects External Video For Everybody: from n/a through <= 2.1.1.

  • CVE-2025-25096MedFeb 7, 2025
    WordPress
    Rss In Page
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.This issue affects RSS in Page: from n/a through <= 2.9.1.

  • CVE-2025-25095MedFeb 7, 2025
    WordPress
    Reverbnation Widgets
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.

  • CVE-2025-25094MedFeb 7, 2025
    WordPress
    Breaking News Ticker
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker allows Stored XSS.This issue affects Breaking News Ticker: from n/a through <= 2.4.4.

  • CVE-2025-25091MedFeb 7, 2025
    WordPress
    Nextgen Cooliris Gallery
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.

  • CVE-2025-25085MedFeb 7, 2025
    WordPress
    Wp Simpleweather
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.

  • CVE-2025-25082MedFeb 7, 2025
    Max Chirkov
    FlexIDX Home Search
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.

  • CVE-2025-25080MedFeb 7, 2025
    WordPress
    Kona Gallery Block
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.