cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 156

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.1CVE-2021-47769EPSS 0.3%

    Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on previ…

  2. 5.3CVE-2021-47768EPSS 0.4%

    ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execu…

  3. 4.8CVE-2026-22919EPSS 0.3%

    An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.

  4. 6.1CVE-2026-22913EPSS 0.4%

    Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data.

  5. 5.4CVE-2025-14448EPSS 0.2%

    The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions up to, and including, 3.5.4.3 due to insufficient input sa…

  6. 5.1CVE-2026-0601EPSS 0.4%

    A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

  7. 1.3CVE-2026-23497EPSS 0.2%

    Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerability where a specially crafted image filename could execute malicious JavaScript w…

  8. 4.8CVE-2025-71166EPSS 0.2%

    Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML outpu…

  9. 4.8CVE-2025-71165EPSS 0.2%

    Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response with…

  10. 4.8CVE-2025-71164EPSS 0.2%

    Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute …

  11. 4.8CVE-2025-14557EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.

  12. 4.8CVE-2025-14556EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

  13. 5.4CVE-2025-11224EPSS 0.3%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through imprope…

  14. 5.4CVE-2025-63644EPSS 0.3%

    A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.

  15. 8.7CVE-2026-22787EPSS 0.4%

    html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not suffi…

  16. 5.4CVE-2025-67834EPSS 0.3%

    Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter.

  17. 6.1CVE-2025-67833EPSS 0.3%

    Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter.

  18. 4.8CVE-2025-37185EPSS 0.3%

    Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A…

  19. 4.4CVE-2026-0813EPSS 0.2%

    The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and ou…

  20. 4.4CVE-2026-0812EPSS 0.2%

    The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'linkedin_sc_api_key', and 'linkedin_sc_secret_key' parameters in all versions up to, and including, 1.1.9 due to insuffic…

  21. 4.4CVE-2026-0741EPSS 0.2%

    The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes…

  22. 4.4CVE-2026-0739EPSS 0.3%

    The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possibl…

  23. 4.4CVE-2026-0734EPSS 0.2%

    The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it …

  24. 6.4CVE-2026-0694EPSS 0.3%

    The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when output…

  25. 4.4CVE-2026-0680EPSS 0.2%

    The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possibl…

  26. 6.1CVE-2026-0594ExploitEPSS 0.8%

    The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it pos…

  27. 4.4CVE-2025-15486EPSS 0.3%

    The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages witho…

  28. 7.2CVE-2025-15378EPSS 0.3%

    The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all versions up to, and including, 1.0 due to missing authorization and nonce verific…

  29. 7.2CVE-2025-15283EPSS 0.4%

    The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters in all versions up to, and including, 1.30.3 due to insufficient input sanitiza…

  30. 7.2CVE-2025-15266EPSS 0.3%

    The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all versions up to, and including, 1.1.8 due to insufficient inp…

  31. 4.4CVE-2025-15021EPSS 0.2%

    The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possibl…

  32. 4.4CVE-2025-14725EPSS 0.2%

    The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for…

  33. 4.4CVE-2025-14379EPSS 0.2%

    The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi…

  34. 4.4CVE-2025-13627EPSS 0.2%

    The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible…

  35. 6.4CVE-2025-12178EPSS 0.2%

    The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user suppl…

  36. 5.1CVE-2023-54341EPSS 0.4%

    Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-contro…

  37. 5.1CVE-2023-54332EPSS 0.3%

    Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbit…

  38. 5.1CVE-2023-53985EPSS 0.3%

    Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual ins…

  39. 5.1CVE-2022-50937EPSS 0.3%

    Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in link text and descriptions to execute persistent attacks that…

  40. 5.1CVE-2022-50908EPSS 0.3%

    Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails with XSS payloads to execute arbitrary API calls, including m…

  41. 4.8CVE-2022-50906EPSS 0.4%

    e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload S…

  42. 6.1CVE-2022-50905EPSS 0.7%

    e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the com…

  43. 5.1CVE-2022-50896EPSS 0.4%

    Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a specially encoded payload in the redirect parameter to execute…

  44. 5.1CVE-2022-50891EPSS 0.3%

    Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. Attackers can craft URLs targeting the download and list endp…

  45. 5.1CVE-2021-47750EPSS 0.4%

    YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers can craft special signup URLs with embedded script tags to ex…

  46. 5.1CVE-2020-36919EPSS 0.4%

    WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browse…

  47. 4.8CVE-2025-68658EPSS 0.2%

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration (Information) functiona…

  48. 5.1CVE-2025-15056EPSS 0.3%

    A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.

  49. 5.4CVE-2026-20959EPSS 7.7%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  50. 8.4CVE-2025-9427EPSS 0.4%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting (XSS).This issue affects WordPress add on: 2025.7.1.