CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 923 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2012-6716 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. | ||
| CVE-2018-20977 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. | ||
| CVE-2018-20970 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. | ||
| CVE-2017-18562 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18561 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The embed-comment-images plugin before 0.6 for WordPress has XSS. | ||
| CVE-2017-18559 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. | ||
| CVE-2017-18535 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The smokesignal plugin before 1.2.7 for WordPress has XSS. | ||
| CVE-2017-18525 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The megamenu plugin before 2.4 for WordPress has XSS. | ||
| CVE-2017-18516 | Med | 0.40 | 6.1 | 0.02 | Aug 21, 2019 | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. | ||
| CVE-2014-10378 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The duplicate-post plugin before 2.6 for WordPress has XSS. | ||
| CVE-2014-10377 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. | ||
| CVE-2012-6714 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. | ||
| CVE-2017-18564 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The sender plugin before 1.2.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18563 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. | ||
| CVE-2016-10912 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The universal-analytics plugin before 1.3.1 for WordPress has XSS. | ||
| CVE-2016-10911 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. | ||
| CVE-2016-10910 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. | ||
| CVE-2015-9328 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 2.2.5 for WordPress has XSS. | ||
| CVE-2015-9327 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. | ||
| CVE-2014-10380 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. |
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- risk 0.40cvss 6.1epss 0.01
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The embed-comment-images plugin before 0.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The smokesignal plugin before 1.2.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The megamenu plugin before 2.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The duplicate-post plugin before 2.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
- risk 0.40cvss 6.1epss 0.01
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
- risk 0.40cvss 6.1epss 0.01
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
- risk 0.40cvss 6.1epss 0.01
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 2.2.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.