cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 2

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2026-116520EPSS 0.4%

    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, a…

  2. 7.2CVE-2026-109997EPSS 0.4%

    The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.…

  3. 7.2CVE-2026-109234EPSS 0.4%

    The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escapin…

  4. 7.5CVE-2026-111578EPSS 0.3%

    The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — b…

  5. 8.7CVE-2026-62990EPSS 0.2%

    Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the adminis…

  6. 5.3CVE-2026-117645EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoe…

  7. 7.1CVE-2026-94175EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

  8. 5.1CVE-2026-7004EPSS 0.3%

    WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to …

  9. 7.1CVE-2026-54855EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

  10. 7.1CVE-2026-48201EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

  11. 7.1CVE-2026-39786EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

  12. 6.5CVE-2026-39739EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for El…

  13. 7.1CVE-2026-28160EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.

  14. 6.5CVE-2026-27061EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

  15. 6.5CVE-2026-116854EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

  16. 7.1CVE-2026-116851EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

  17. 7.1CVE-2026-116847EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.

  18. 7.1CVE-2026-116405EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.

  19. 6.5CVE-2026-114711EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

  20. 7.1CVE-2026-105077EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.

  21. 6.4CVE-2026-9239EPSS 0.3%

    The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This …

  22. 7.2CVE-2026-96894EPSS 0.4%

    The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitizatio…

  23. 7.4CVE-2026-119764EPSS 0.3%

    Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator do…

  24. 5.3CVE-2026-119761EPSS 0.3%

    Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers …

  25. 6.4CVE-2026-119176EPSS 0.3%

    The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This m…

  26. 6.4CVE-2026-119113EPSS 0.4%

    The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This i…

  27. 4.7CVE-2026-116552EPSS 0.3%

    The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization an…

  28. 6.4CVE-2026-115869EPSS 0.3%

    The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization …

  29. 7.2CVE-2026-112365EPSS 0.5%

    The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 du…

  30. 6.4CVE-2026-110533EPSS 0.3%

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sani…

  31. 5.4CVE-2026-110001EPSS 0.3%

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitiza…

  32. 5.4CVE-2026-109984EPSS 0.4%

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This…

  33. 7.2CVE-2026-104744EPSS 0.3%

    The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This …

  34. 6.4CVE-2026-102918EPSS 0.3%

    The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attrib…

  35. 8.1CVE-2026-61804EPSS 0.3%

    myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through un…

  36. 5.1CVE-2026-39375EPSS 0.3%

    Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the…

  37. 6.5CVE-2026-119365EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue af…

  38. 6.5CVE-2026-119369EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through…

  39. 5.3CVE-2026-105456EPSS 0.4%

    RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change appl…

  40. 5.3CVE-2026-105455EPSS 0.4%

    RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script run…

  41. 5.3CVE-2026-105454EPSS 0.4%

    RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displ…

  42. 6.5CVE-2026-65444EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.

  43. 9.9CVE-2026-61728EPSS 0.5%

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stor…

  44. 4.7CVE-2026-48164EPSS 0.3%

    Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unli…

  45. 8.9CVE-2026-45144EPSS 0.2%

    Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, an…

  46. 8.5CVE-2026-119680EPSS 0.2%

    A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript int…

  47. 6.5CVE-2026-119370EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through…

  48. 5.1CVE-2015-20130EPSS 0.3%

    Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code throu…

  49. 5.1CVE-2026-119563EPSS 0.2%

    phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name…

  50. 5.1CVE-2025-68395EPSS 0.2%

    ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. …