VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 500 of 2,429
  • CVE-2024-44059MedSep 15, 2024
    Ronald Huereca
    Custom Query Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.3.1.

  • CVE-2024-44058MedSep 15, 2024
    Cryoutcreations
    Parabola
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This issue affects Parabola: from n/a through 2.4.1.

  • CVE-2024-44057MedSep 15, 2024
    Cryoutcreations
    Nirvana
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This issue affects Nirvana: from n/a through 1.6.3.

  • CVE-2024-44056MedSep 15, 2024
    Cryoutcreations
    Mantra
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issue affects Mantra: from n/a through 3.3.2.

  • CVE-2024-44054MedSep 15, 2024
    Cryoutcreations
    Fluida
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issue affects Fluida: from n/a through 1.8.8.

  • CVE-2024-45457MedSep 15, 2024
    Spiffyplugins
    Spiffy Calendar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.

  • CVE-2024-45456MedSep 15, 2024
    Joomunited
    Wp Meta Seo
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.

  • CVE-2024-44063MedSep 15, 2024
    Happyforms
    Happyforms
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.

  • CVE-2024-44062MedSep 15, 2024
    Wpgogo
    Custom Field Template
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.

  • CVE-2024-8747MedSep 13, 2024
    WordPress
    Email Obfuscate Shortcode
    risk 0.42cvss 6.4epss 0.00

    The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  • CVE-2024-5884MedSep 13, 2024
    WordPress
    Beauty
    risk 0.42cvss 6.4epss 0.00

    The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

  • CVE-2024-5870MedSep 13, 2024
    WordPress
    Tweaker5
    risk 0.42cvss 6.4epss 0.00

    The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-5869MedSep 13, 2024
    WordPress
    Neighborly
    risk 0.42cvss 6.4epss 0.00

    The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-5867MedSep 13, 2024
    WordPress
    Delicate
    risk 0.42cvss 6.4epss 0.00

    The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-5789MedSep 13, 2024
    WordPress
    Triton Lite
    risk 0.42cvss 6.4epss 0.00

    The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-5567MedSep 13, 2024
    WordPress
    Betheme
    risk 0.42cvss 6.4epss 0.00

    The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level…

  • CVE-2024-5628MedSep 13, 2024
    Avada
    Avada | Website Builder For WordPress & eCommerce
    risk 0.42cvss 6.4epss 0.00

    The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insufficient input sanitization and output escaping on user…

  • CVE-2024-8045MedSep 11, 2024
    WordPress
    Advanced WordPress Backgrounds
    risk 0.42cvss 6.4epss 0.00

    The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2024-8440MedSep 11, 2024
    WordPress
    Essential Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input…

  • CVE-2024-8543MedSep 10, 2024
    WordPress
    Slider comparison image before and after
    risk 0.42cvss 6.4epss 0.00

    The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes.…