VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 561 of 2,429
  • CVE-2023-40197MedSep 4, 2023
    Flowpaper
    Flowpaper
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Devaldi Ltd flowpaper plugin <= 1.9.9 versions.

  • CVE-2023-32578MedSep 4, 2023
    WordPress
    Column-Matic
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Twinpictures Column-Matic plugin <= 1.3.3 versions.

  • CVE-2023-32102MedSep 4, 2023
    Pexlechris
    Library Viewer
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Pexle Chris Library Viewer plugin <= 2.0.6 versions.

  • CVE-2023-39988MedSep 4, 2023
    Tencent
    Wxsync
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 标准云(std.Cloud) WxSync plugin <= 2.7.23 versions.

  • CVE-2023-38516MedSep 3, 2023
    Essentialplugin
    Audio Player With Playlist Ultimate
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.

  • CVE-2023-4718MedSep 2, 2023
    WordPress
    Font Awesome 4 Menus
    risk 0.42cvss 6.4epss 0.01

    The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-41049HigSep 1, 2023
    Decentraland
    Single Sign On Client
    risk 0.42cvss 7.5epss 0.00

    @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on…

  • CVE-2023-37994MedSep 1, 2023
    Wpruse
    Art Decoration Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions.

  • CVE-2023-35094MedAug 30, 2023
    Mpembed
    Wp Matterport Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin <= 2.1.4 versions.

  • CVE-2023-34004MedAug 30, 2023
    WooCommerce
    Box Office
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.

  • CVE-2023-32793MedAug 30, 2023
    WooCommerce
    Woocommerce Pre Orders
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.

  • CVE-2023-32746MedAug 30, 2023
    WooCommerce
    Brands
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.

  • CVE-2023-26270MedAug 28, 2023
    IBM
    Guardium Cloud Key Manager
    risk 0.42cvss 6.5epss 0.01

    IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this…

  • CVE-2023-25981MedAug 25, 2023
    Themekraft
    Post Form
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.

  • CVE-2023-32576MedAug 25, 2023
    Plainware
    Locatoraid
    risk 0.42cvss 6.5epss 0.00

    Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.

  • CVE-2023-29387MedAug 18, 2023
    Juliencrego
    Manager For Icomoon
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.

  • CVE-2023-32103MedAug 18, 2023
    Themepalace
    Tp Education
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

  • CVE-2023-31079MedAug 17, 2023
    Thechrisroberts
    Tippy
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Roberts Tippy plugin <= 6.2.1 versions.

  • CVE-2023-30784MedAug 16, 2023
    Kayastudio
    Kaya Qr Code Generator
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.

  • CVE-2023-37983MedAug 10, 2023
    Noël Jackson
    Art Direction
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Noël Jackson Art Direction plugin <= 0.2.4 versions.