VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 563 of 2,429
  • CVE-2023-3412MedJun 27, 2023
    WordPress
    Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
    risk 0.42cvss 6.4epss 0.00

    The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it…

  • CVE-2023-29437MedJun 26, 2023
    Steven A. Zahm
    Connections Business Directory
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions.

  • CVE-2023-29435MedJun 26, 2023
    WordPress
    Cryptocurrency All-in-One
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Zwaply Cryptocurrency All-in-One plugin <= 3.0.19 versions.

  • CVE-2023-29436MedJun 26, 2023
    Flyn San
    Iframe Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions.

  • CVE-2023-1783MedJun 23, 2023
    Orangescrum
    Orangescrum
    risk 0.42cvss 6.5epss 0.01

    OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

  • CVE-2023-35090MedJun 22, 2023
    WordPress
    MasterStudy LMS
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.

  • CVE-2023-31213MedJun 22, 2023
    Wpbakery
    Page Builder
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions.

  • CVE-2023-28534MedJun 22, 2023
    Wpjobportal
    Wp Job Portal
    risk 0.42cvss 6.5epss 0.00

    Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions.

  • CVE-2023-27631MedJun 22, 2023
    Mmrs151
    Daily Prayer Time
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.

  • CVE-2023-27629MedJun 22, 2023
    Geminilabs
    Site Reviews
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

  • CVE-2023-27612MedJun 22, 2023
    Geminilabs
    Site Reviews
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

  • CVE-2023-27413MedJun 22, 2023
    W4 Post List Project
    W4 Post List
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions.

  • CVE-2023-27443MedJun 21, 2023
    Grant Kimball
    Simple Vimeo Shortcode
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Grant Kimball Simple Vimeo Shortcode plugin <= 2.9.1 versions.

  • CVE-2023-35882MedJun 20, 2023
    Heateor
    Super Socializer
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.

  • CVE-2023-32659MedJun 19, 2023
    SUBNET Solutions Inc.
    Powersystem Center
    risk 0.42cvss 6.5epss 0.00

    SUBNET PowerSYSTEM Center versions 2020 U10 and prior contain a cross-site scripting vulnerability that may allow an attacker to inject malicious code into report header graphic files that could propagate out of the system and reach users who are subscribed to email…

  • CVE-2023-35776MedJun 19, 2023
    Bearsthemes
    Sermons Online
    risk 0.42cvss 6.5epss 0.01

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.

  • CVE-2023-26013MedJun 16, 2023
    Wpchill
    Strong Testimonials
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill Strong Testimonials plugin <= 3.0.2 versions.

  • CVE-2023-23831MedJun 13, 2023
    WordPress
    Rating-Widget: Star Review System
    risk 0.42cvss 6.5epss 0.00

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rating-Widget Rating-Widget: Star Review System plugin <= 3.1.9 versions.

  • CVE-2023-33984MedJun 13, 2023
    SAP
    Netweaver
    risk 0.42cvss 6.4epss 0.00

    SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain…

  • CVE-2023-2305MedJun 9, 2023
    WordPress
    Download Manager
    risk 0.42cvss 6.4epss 0.01

    The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied…