VYPR

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

VariantIncompleteLikelihood: High

Description

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-18 · CAPEC-193 · CAPEC-32 · CAPEC-86

CVEs mapped to this weakness (602)

page 6 of 31
  • CVE-2025-11160MedOct 15, 2025
    Wpbakery
    Page Builder
    risk 0.42cvss 6.4epss 0.00

    The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS…

  • CVE-2025-11241MedOct 3, 2025
    WordPress
    Yoast SEO Premium
    risk 0.42cvss 6.4epss 0.00

    The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This…

  • CVE-2025-10128MedSep 30, 2025
    WordPress
    Eulerpool Research Systems
    risk 0.42cvss 6.4epss 0.00

    The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2025-10125MedSep 17, 2025
    WordPress
    Memberlite Shortcodes
    risk 0.42cvss 6.4epss 0.00

    The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2025-8621MedAug 12, 2025
    WordPress
    Mosaic Generator
    risk 0.42cvss 6.4epss 0.00

    The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

  • CVE-2025-52897MedJul 30, 2025
    Glpi Project
    Glpi
    risk 0.42cvss 6.5epss 0.00

    GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.

  • CVE-2025-52902HigJun 26, 2025
    Filebrowser
    Filebrowser
    risk 0.42cvss 7.6epss 0.00

    File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript…

  • CVE-2025-4367MedJun 19, 2025
    WordPress
    Download Manager
    risk 0.42cvss 6.4epss 0.00

    The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2025-5686MedJun 6, 2025
    WordPress
    Paged Gallery
    risk 0.42cvss 6.4epss 0.00

    The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2025-4126MedMay 15, 2025
    WordPress
    EG-Series
    risk 0.42cvss 6.4epss 0.00

    The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function.…

  • CVE-2025-4168MedMay 3, 2025
    WordPress
    Subpage List
    risk 0.42cvss 6.4epss 0.00

    The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2025-3521MedMay 1, 2025
    WordPress
    Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
    risk 0.42cvss 6.4epss 0.00

    The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output…

  • CVE-2025-39524MedApr 16, 2025
    WordPress
    Html5 Audio Player
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.

  • CVE-2025-31604MedMar 31, 2025
    Calcom
    Cal.com
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal.com: from n/a through <= 1.0.0.

  • CVE-2025-31075MedMar 28, 2025
    WordPress
    MicroPayments
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.

  • CVE-2025-25363MedMar 13, 2025
    The Plugin People
    Enterprise Mail Handler for Jira Data Center (JEMH)
    risk 0.42cvss 6.5epss 0.00

    An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting…

  • CVE-2024-57004MedFeb 3, 2025
    Roundcube
    Webmail
    risk 0.42cvss 6.1epss 0.29

    Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

  • CVE-2025-24678MedJan 24, 2025
    WordPress
    Listamester
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.

  • CVE-2025-24673MedJan 24, 2025
    WordPress
    Ketchup Shortcodes Pack
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.

  • CVE-2024-10592MedNov 16, 2024
    WordPress
    Mapster Wp Maps
    risk 0.42cvss 6.4epss 0.01

    The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…