CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

CWE-74

Children

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,563)

page 919 of 2,429

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2015-9372	Ithemes Membership	Med	0.40	6.1	0.01	Aug 28, 2019	Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9371	Ithemes Manual Purchases	Med	0.40	6.1	0.01	Aug 28, 2019	Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9370	Ithemes Invoices	Med	0.40	6.1	0.01	Aug 28, 2019	Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9369	Ithemes Easy Us Sales Taxes	Med	0.40	6.1	0.01	Aug 28, 2019	Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2019-15713	WordPress My Calendar	Med	0.40	6.1	0.02	Aug 28, 2019	The my-calendar plugin before 3.1.10 for WordPress has XSS.
CVE-2017-18593	Updraftplus Updraftplus	Med	0.40	6.1	0.01	Aug 28, 2019	The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
CVE-2015-9368	WordPress Easy EU Value Added (VAT) Taxes Add-on	Med	0.40	6.1	0.01	Aug 28, 2019	Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9367	Ithemes Easy Canadian Sales Taxes	Med	0.40	6.1	0.01	Aug 28, 2019	Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9366	Ithemes Custom URL Tracking	Med	0.40	6.1	0.01	Aug 28, 2019	Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9365	Ithemes Authorize.net	Med	0.40	6.1	0.01	Aug 28, 2019	Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9364	WordPress 2Checkout Add-on for iThemes Exchange	Med	0.40	6.1	0.01	Aug 28, 2019	2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9363	Ithemes Exchange	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9362	WordPress Post Connector	Med	0.40	6.1	0.01	Aug 28, 2019	The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9361	WordPress Related Posts	Med	0.40	6.1	0.01	Aug 28, 2019	The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9360	Updraftplus Updraftplus	Med	0.40	6.1	0.01	Aug 28, 2019	The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9358	WordPress FeedWordPress	Med	0.40	6.1	0.01	Aug 28, 2019	The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9357	WordPress Akismet	Med	0.40	6.1	0.01	Aug 28, 2019	The akismet plugin before 3.1.5 for WordPress has XSS.
CVE-2015-9356	WordPress Wp Vipergb	Med	0.40	6.1	0.01	Aug 28, 2019	The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
CVE-2015-9355	WordPress Two Factor Authentication	Med	0.40	6.1	0.01	Aug 28, 2019	The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
CVE-2012-6718	WordPress Sharebar	Med	0.40	6.1	0.01	Aug 28, 2019	The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.

CVE-2015-9372MedAug 28, 2019
Ithemes
Membership
risk 0.40cvss 6.1epss 0.01
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9371MedAug 28, 2019
Ithemes
Manual Purchases
risk 0.40cvss 6.1epss 0.01
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9370MedAug 28, 2019
Ithemes
Invoices
risk 0.40cvss 6.1epss 0.01
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9369MedAug 28, 2019
Ithemes
Easy Us Sales Taxes
risk 0.40cvss 6.1epss 0.01
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2019-15713MedAug 28, 2019
WordPress
My Calendar
risk 0.40cvss 6.1epss 0.02
The my-calendar plugin before 3.1.10 for WordPress has XSS.
CVE-2017-18593MedAug 28, 2019
Updraftplus
Updraftplus
risk 0.40cvss 6.1epss 0.01
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
CVE-2015-9368MedAug 28, 2019
WordPress
Easy EU Value Added (VAT) Taxes Add-on
risk 0.40cvss 6.1epss 0.01
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9367MedAug 28, 2019
Ithemes
Easy Canadian Sales Taxes
risk 0.40cvss 6.1epss 0.01
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9366MedAug 28, 2019
Ithemes
Custom URL Tracking
risk 0.40cvss 6.1epss 0.01
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9365MedAug 28, 2019
Ithemes
Authorize.net
risk 0.40cvss 6.1epss 0.01
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9364MedAug 28, 2019
WordPress
2Checkout Add-on for iThemes Exchange
risk 0.40cvss 6.1epss 0.01
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9363MedAug 28, 2019
Ithemes
Exchange
risk 0.40cvss 6.1epss 0.01
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9362MedAug 28, 2019
WordPress
Post Connector
risk 0.40cvss 6.1epss 0.01
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9361MedAug 28, 2019
WordPress
Related Posts
risk 0.40cvss 6.1epss 0.01
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9360MedAug 28, 2019
Updraftplus
Updraftplus
risk 0.40cvss 6.1epss 0.01
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9358MedAug 28, 2019
WordPress
FeedWordPress
risk 0.40cvss 6.1epss 0.01
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9357MedAug 28, 2019
WordPress
Akismet
risk 0.40cvss 6.1epss 0.01
The akismet plugin before 3.1.5 for WordPress has XSS.
CVE-2015-9356MedAug 28, 2019
WordPress
Wp Vipergb
risk 0.40cvss 6.1epss 0.01
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
CVE-2015-9355MedAug 28, 2019
WordPress
Two Factor Authentication
risk 0.40cvss 6.1epss 0.01
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
CVE-2012-6718MedAug 28, 2019
WordPress
Sharebar
risk 0.40cvss 6.1epss 0.01
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.