CWE-82

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

VariantIncomplete

Description

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Attackers can embed XSS exploits into the values for IMG attributes (e.g. SRC) that is streamed and then executed in a victim's browser. Note that when the page is loaded into a user's browsers, the exploit will automatically execute.

Hierarchy (View 1000)

Parents

CWE-83

Children

none

CVEs mapped to this weakness (6)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-52427	Event Tickets with Ticket Scanner Event Tickets with Ticket Scanner	Cri	0.65	9.9	0.01	Nov 18, 2024	Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
CVE-2024-52434	Supsystic Popup	Cri	0.59	9.1	0.01	Nov 18, 2024	Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
CVE-2024-52393	Podlove Podlove Podcast Publisher	Cri	0.59	9.1	0.01	Nov 14, 2024	Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
CVE-2024-49271	Unlimited Elements Unlimited Elements For Elementor	Cri	0.59	9.1	0.01	Oct 16, 2024	Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons,…
CVE-2024-48042	WordPress Contact Form By Supsystic	Cri	0.59	9.1	0.01	Oct 16, 2024	Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
CVE-2025-53194	WordPress Jetengine	Hig	0.55	8.5	0.00	Aug 20, 2025	Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

CVE-2024-52427CriNov 18, 2024
Event Tickets with Ticket Scanner
Event Tickets with Ticket Scanner
risk 0.65cvss 9.9epss 0.01
Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
CVE-2024-52434CriNov 18, 2024
Supsystic
Popup
risk 0.59cvss 9.1epss 0.01
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
CVE-2024-52393CriNov 14, 2024
Podlove
Podlove Podcast Publisher
risk 0.59cvss 9.1epss 0.01
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
CVE-2024-49271CriOct 16, 2024
Unlimited Elements
Unlimited Elements For Elementor
risk 0.59cvss 9.1epss 0.01
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons,…
CVE-2024-48042CriOct 16, 2024
WordPress
Contact Form By Supsystic
risk 0.59cvss 9.1epss 0.01
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
CVE-2025-53194HigAug 20, 2025
WordPress
Jetengine
risk 0.55cvss 8.5epss 0.00
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.