VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 512 of 2,429
  • CVE-2024-5173MedJun 26, 2024
    WordPress
    HT Mega – Absolute Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2024-5451MedJun 25, 2024
    WordPress
    The7 — Website and eCommerce Builder for WordPress
    risk 0.42cvss 6.4epss 0.00

    The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's Icon and Heading widgets in all versions up to, and including, 11.13.0 due to insufficient input sanitization and…

  • CVE-2024-31111MedJun 25, 2024
    WordPress
    WordPress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from…

  • CVE-2024-5966MedJun 22, 2024
    WordPress
    Grey Opaque
    risk 0.42cvss 6.4epss 0.00

    The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it…

  • CVE-2024-5965MedJun 22, 2024
    WordPress
    Mosaic
    risk 0.42cvss 6.4epss 0.00

    The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-5346MedJun 22, 2024
    WordPress
    Flatsome
    risk 0.42cvss 6.4epss 0.00

    The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output…

  • CVE-2024-4313MedJun 22, 2024
    WordPress
    Table Addons for Elementor
    risk 0.42cvss 6.4epss 0.00

    The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

  • CVE-2024-2484MedJun 22, 2024
    WordPress
    Orbit Fox
    risk 0.42cvss 6.4epss 0.00

    The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in all versions up to, and including, 2.10.34 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-35764MedJun 21, 2024
    Church Admin Project
    Church Admin
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

  • CVE-2024-35763MedJun 21, 2024
    Themefreesia
    Excellent
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Excellent allows Stored XSS.This issue affects Excellent: from n/a through 1.2.9.

  • CVE-2024-35762MedJun 21, 2024
    Cryoutcreations
    Serious Slider
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4.

  • CVE-2024-35761MedJun 21, 2024
    WordPress
    Online Booking & Scheduling Calendar for WordPress by vcita
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from…

  • CVE-2024-35758MedJun 21, 2024
    Themehorse
    Interface
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Horse Interface allows Stored XSS.This issue affects Interface: from n/a through 3.1.0.

  • CVE-2024-5058MedJun 21, 2024
    Wpdeveloper
    Typing Text
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows Stored XSS.This issue affects Typing Text: from n/a through 1.2.5.

  • CVE-2024-35779MedJun 21, 2024
    Blueastral
    Page Builder\
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.

  • CVE-2024-35774MedJun 21, 2024
    Darteweb
    Dimage 360
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in D’arteweb DImage 360 allows Stored XSS.This issue affects DImage 360: from n/a through 2.0.

  • CVE-2024-37350MedJun 20, 2024
    Absolute
    Secure Access
    risk 0.42cvss 6.5epss 0.00

    There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a…

  • CVE-2024-5156MedJun 20, 2024
    WordPress
    Flatsome
    risk 0.42cvss 6.4epss 0.00

    The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-49111MedJun 20, 2024
    Kiuwan
    Kiuwan Sast
    risk 0.42cvss 6.5epss 0.01

    For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block…

  • CVE-2024-5686MedJun 20, 2024
    Wpzoom
    Wpzoom Addons For Elementor
    risk 0.42cvss 6.4epss 0.00

    The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and…