VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 562 of 2,429
  • CVE-2023-24393MedAug 10, 2023
    Sk. Abul Hasan
    Animated Number Counters
    risk 0.42cvss 6.5epss 0.00

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <= 1.6 versions.

  • CVE-2023-23828MedAug 10, 2023
    Swas
    Wp Category Post List
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Swashata WP Category Post List Widget plugin <= 2.0.3 versions.

  • CVE-2023-23798MedAug 10, 2023
    Web Settler
    Layer Slider
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

  • CVE-2023-23826MedAug 10, 2023
    Webmechanix
    Add Posts To Pages
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arsham Mirshah Add Posts to Pages plugin <= 1.4.1 versions.

  • CVE-2023-22843MedAug 9, 2023
    Nozominetworks
    Threat Intelligence
    risk 0.42cvss 6.4epss 0.00

    An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a…

  • CVE-2023-30482MedAug 8, 2023
    Villatheme
    WPBulky
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <= 1.0.10 versions.

  • CVE-2023-28773MedAug 8, 2023
    Kolja Nolte
    Secondary Title
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kolja Nolte Secondary Title plugin <= 2.0.9.1 versions.

  • CVE-2023-23880MedAug 8, 2023
    ExactMetrics
    Exactmetrics
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExactMetrics plugin <= 7.14.1 versions.

  • CVE-2023-23877MedAug 8, 2023
    Bkmacdaddy
    Pinterest Rss Widget
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin <= 2.3.1 versions.

  • CVE-2023-23829MedAug 8, 2023
    Pierre Jehan
    Owl Carousel
    risk 0.42cvss 6.5epss 0.00

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pierre JEHAN Owl Carousel plugin <= 0.5.3 versions.

  • CVE-2022-45821MedAug 8, 2023
    NooTheme
    Noo Timetable
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

  • CVE-2023-29099MedAug 8, 2023
    Elegantthemes
    Divi
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Elegant themes Divi theme <= 4.20.2 versions.

  • CVE-2023-32600MedAug 6, 2023
    Rankmath
    Seo
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions.

  • CVE-2023-37970MedJul 27, 2023
    Mf Gig Calendar Project
    Mf Gig Calendar
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Matthew Fries MF Gig Calendar plugin <= 1.2 versions.

  • CVE-2023-28013MedJul 26, 2023
    HCLTech
    Verse
    risk 0.42cvss 6.5epss 0.00

    HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's…

  • CVE-2023-36503MedJul 25, 2023
    WordPress
    Maxbuttons
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.

  • CVE-2023-23833MedJul 25, 2023
    Drop Shadow Boxes Project
    Drop Shadow Boxes
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <= 1.7.10 versions.

  • CVE-2023-2082MedJul 14, 2023
    WordPress
    Buy Me a Coffee – Button and Widget Plugin
    risk 0.42cvss 6.4epss 0.01

    The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for…

  • CVE-2021-39014MedJul 7, 2023
    IBM
    Cloud Object System
    risk 0.42cvss 6.4epss 0.00

    IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2023-34244MedJul 5, 2023
    Glpi Project
    Glpi
    risk 0.42cvss 6.5epss 0.01

    GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade…