CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 922 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-20983 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wp-retina-2x plugin before 5.2.3 for WordPress has XSS. | ||
| CVE-2017-18582 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18581 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. | ||
| CVE-2017-18577 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. | ||
| CVE-2017-18576 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. | ||
| CVE-2016-10925 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. | ||
| CVE-2014-10385 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST. | ||
| CVE-2013-7482 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The reflex-gallery plugin before 1.4.3 for WordPress has XSS. | ||
| CVE-2008-7321 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The tubepress plugin before 1.6.5 for WordPress has XSS. | ||
| CVE-2018-20982 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens. | ||
| CVE-2017-18575 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. | ||
| CVE-2017-18572 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The gnucommerce plugin before 1.4.2 for WordPress has XSS. | ||
| CVE-2016-10920 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS. | ||
| CVE-2016-10919 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633. | ||
| CVE-2015-9336 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. | ||
| CVE-2013-7481 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | ||
| CVE-2013-7480 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | ||
| CVE-2013-7479 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | ||
| CVE-2013-7478 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | ||
| CVE-2013-7477 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. |
- risk 0.40cvss 6.1epss 0.01
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
- risk 0.40cvss 6.1epss 0.01
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
- risk 0.40cvss 6.1epss 0.01
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
- risk 0.40cvss 6.1epss 0.01
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
- risk 0.40cvss 6.1epss 0.01
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
- risk 0.40cvss 6.1epss 0.01
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The tubepress plugin before 1.6.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
- risk 0.40cvss 6.1epss 0.01
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
- risk 0.40cvss 6.1epss 0.01
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
- risk 0.40cvss 6.1epss 0.01
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.