CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 926 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18518 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. | ||
| CVE-2016-10895 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. | ||
| CVE-2016-10892 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. | ||
| CVE-2015-9320 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. | ||
| CVE-2015-9319 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. | ||
| CVE-2017-18568 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The my-wp-translate plugin before 1.0.4 for WordPress has XSS. | ||
| CVE-2017-18567 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.6 for WordPress has XSS. | ||
| CVE-2017-18520 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. | ||
| CVE-2017-18517 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. | ||
| CVE-2016-10913 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. | ||
| CVE-2015-9329 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. | ||
| CVE-2015-9317 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages. | ||
| CVE-2019-15233 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie. | ||
| CVE-2019-15082 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. | ||
| CVE-2019-15227 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions. | ||
| CVE-2019-6159 | Med | 0.40 | 6.1 | 0.01 | Aug 19, 2019 | A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM… | ||
| CVE-2019-15116 | Med | 0.40 | 6.1 | 0.01 | Aug 16, 2019 | The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | ||
| CVE-2017-18542 | Med | 0.40 | 6.1 | 0.01 | Aug 16, 2019 | The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. | ||
| CVE-2017-18541 | Med | 0.40 | 6.1 | 0.01 | Aug 16, 2019 | The xo-security plugin before 1.5.3 for WordPress has XSS. | ||
| CVE-2019-15095 | Med | 0.40 | 6.1 | 0.01 | Aug 16, 2019 | DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter. |
- risk 0.40cvss 6.1epss 0.02
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
- risk 0.40cvss 6.1epss 0.01
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
- risk 0.40cvss 6.1epss 0.01
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
- risk 0.40cvss 6.1epss 0.01
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
- risk 0.40cvss 6.1epss 0.02
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
- risk 0.40cvss 6.1epss 0.01
The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie.
- risk 0.40cvss 6.1epss 0.01
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.
- risk 0.40cvss 6.1epss 0.01
A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM…
- risk 0.40cvss 6.1epss 0.01
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
- risk 0.40cvss 6.1epss 0.01
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The xo-security plugin before 1.5.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.