CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 929 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-7475 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 3.52 for WordPress has XSS. | ||
| CVE-2012-6713 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. | ||
| CVE-2019-14976 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter. | ||
| CVE-2019-14967 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. | ||
| CVE-2018-20966 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. | ||
| CVE-2017-18505 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The twitter-plugin plugin before 2.55 for WordPress has XSS. | ||
| CVE-2017-18503 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. | ||
| CVE-2017-18502 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2019 | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. | ||
| CVE-2017-18501 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18500 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18499 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The simple-membership plugin before 3.5.7 for WordPress has XSS. | ||
| CVE-2015-9304 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. | ||
| CVE-2015-9303 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. | ||
| CVE-2019-14950 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. | ||
| CVE-2019-14949 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 5.1.2 for WordPress has XSS. | ||
| CVE-2017-18508 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. | ||
| CVE-2017-18506 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. | ||
| CVE-2016-10879 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. | ||
| CVE-2016-10878 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. | ||
| CVE-2016-10877 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. |
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.
- risk 0.40cvss 6.1epss 0.02
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
- risk 0.40cvss 6.1epss 0.02
The twitter-plugin plugin before 2.55 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The simple-membership plugin before 3.5.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
- risk 0.40cvss 6.1epss 0.01
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.