CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 928 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18497 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The liveforms plugin before 3.4.0 for WordPress has XSS. | ||
| CVE-2017-18496 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18495 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. | ||
| CVE-2017-18494 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. | ||
| CVE-2017-18493 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18492 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. | ||
| CVE-2017-18491 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18490 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18489 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. | ||
| CVE-2016-10870 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The google-language-translator plugin before 5.0.06 for WordPress has XSS. | ||
| CVE-2016-10869 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 4.0.2 for WordPress has XSS. | ||
| CVE-2016-10868 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages. | ||
| CVE-2015-9302 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The simple-fields plugin before 1.4.11 for WordPress has XSS. | ||
| CVE-2015-9300 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. | ||
| CVE-2015-9299 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. | ||
| CVE-2015-9297 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The events-manager plugin before 5.6 for WordPress has XSS. | ||
| CVE-2015-9296 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. | ||
| CVE-2015-9295 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 3.96 for WordPress has XSS. | ||
| CVE-2015-9294 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances. | ||
| CVE-2015-9293 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. |
- risk 0.40cvss 6.1epss 0.01
The liveforms plugin before 3.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
- risk 0.40cvss 6.1epss 0.01
The simple-fields plugin before 1.4.11 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.