VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 466 of 2,429
  • CVE-2024-11906MedDec 17, 2024
    WordPress
    Tpg Get Posts
    risk 0.42cvss 6.4epss 0.00

    The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11905MedDec 17, 2024
    WordPress
    Animated Counters
    risk 0.42cvss 6.4epss 0.00

    The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11902MedDec 17, 2024
    WordPress
    Slope Widgets
    risk 0.42cvss 6.4epss 0.00

    The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and including, 4.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11900MedDec 17, 2024
    WordPress
    Portfolio – Filterable Masonry Portfolio Gallery for Professionals
    risk 0.42cvss 6.4epss 0.00

    The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output…

  • CVE-2024-54348MedDec 16, 2024
    WordPress
    Brand
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affects Brand: from n/a through <= 1.1.6.

  • CVE-2024-56011MedDec 16, 2024
    WordPress
    Responsive Google Maps
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-google-maps allows Stored XSS.This issue affects Responsive Google Maps | by imbaa: from n/a through <= 1.2.5.

  • CVE-2024-54443MedDec 16, 2024
    WordPress
    Advanced Data Table For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.

  • CVE-2024-54441MedDec 16, 2024
    WordPress
    Utech World Time
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.

  • CVE-2024-54360MedDec 16, 2024
    WordPress
    Gutensee
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in premila Gutensee gutensee allows DOM-Based XSS.This issue affects Gutensee: from n/a through <= 1.0.6.

  • CVE-2024-12446MedDec 14, 2024
    WordPress
    Post To PDF
    risk 0.42cvss 6.4epss 0.00

    The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-12501MedDec 14, 2024
    WordPress
    Simple Locator
    risk 0.42cvss 6.4epss 0.00

    The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-12474MedDec 14, 2024
    WordPress
    Geodatasource Country Region Dropdown
    risk 0.42cvss 6.4epss 0.00

    The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-12459MedDec 14, 2024
    WordPress
    Ganohrs Toggle Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11752MedDec 14, 2024
    WordPress
    Eveeno
    risk 0.42cvss 6.4epss 0.00

    The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2024-12523MedDec 14, 2024
    WordPress
    States Map US
    risk 0.42cvss 6.4epss 0.00

    The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-12517MedDec 14, 2024
    WordPress
    WooCommerce Cart Count Shortcode
    risk 0.42cvss 6.4epss 0.00

    The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes.…

  • CVE-2024-12458MedDec 14, 2024
    WordPress
    Smart Popup Blaster
    risk 0.42cvss 6.4epss 0.00

    The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-11894MedDec 14, 2024
    WordPress
    The Permalinker
    risk 0.42cvss 6.4epss 0.00

    The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2024-11884MedDec 14, 2024
    WordPress
    Wp Photo Text Slider 50
    risk 0.42cvss 6.4epss 0.00

    The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2024-11883MedDec 14, 2024
    WordPress
    Connatix Video Embed
    risk 0.42cvss 6.4epss 0.00

    The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…