cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 20

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-88826EPSS 0.2%

    The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store …

  2. 8.8CVE-2026-87764EPSS 0.3%

    The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthentica…

  3. 8.8CVE-2026-87762EPSS 0.4%

    The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has n…

  4. 8.0CVE-2026-87761EPSS 0.3%

    The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values …

  5. 8.8CVE-2026-87760EPSS 0.3%

    The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowi…

  6. 8.8CVE-2026-86798EPSS 0.3%

    The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated user…

  7. 8.8CVE-2026-84261EPSS 0.3%

    The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used…

  8. 8.8CVE-2026-84260EPSS 0.3%

    The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used …

  9. 8.8CVE-2026-84259EPSS 0.3%

    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used agains…

  10. 8.8CVE-2026-84258EPSS 0.3%

    The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used ag…

  11. 6.8CVE-2026-81156EPSS 0.3%

    The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that execut…

  12. 6.8CVE-2026-81155EPSS 0.3%

    The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execu…

  13. 6.8CVE-2026-81154EPSS 0.3%

    The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks th…

  14. 6.8CVE-2026-81153EPSS 0.3%

    The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks …

  15. 6.8CVE-2026-12980EPSS 0.3%

    The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute wh…

  16. 8.8CVE-2026-103305EPSS 0.2%

    The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Script…

  17. 7.1CVE-2026-78534EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

  18. 7.1CVE-2026-78532EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

  19. 7.1CVE-2026-62116EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  20. 7.1CVE-2026-62100EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

  21. 7.1CVE-2026-62095EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

  22. 7.1CVE-2026-62093EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

  23. 7.1CVE-2026-62091EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

  24. 7.1CVE-2026-62082EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

  25. 7.1CVE-2026-62064EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  26. 7.1CVE-2026-62037EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  27. 7.1CVE-2026-62034EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  28. 7.1CVE-2026-62027EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  29. 7.1CVE-2026-57742EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

  30. 7.1CVE-2026-42715EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  31. 7.1CVE-2026-42711EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  32. 7.1CVE-2026-42709EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  33. 7.1CVE-2026-42702EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

  34. 7.1CVE-2026-42699EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  35. 7.1CVE-2026-42697EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & …

  36. 7.1CVE-2026-42693EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

  37. 7.1CVE-2026-42632EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

  38. 7.1CVE-2026-42631EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

  39. 7.1CVE-2026-40803EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

  40. 7.1CVE-2026-39800EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

  41. 7.1CVE-2026-39799EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

  42. 7.1CVE-2026-57806EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketp…

  43. 7.1CVE-2026-94160EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for La…

  44. 7.1CVE-2026-97264EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  45. 7.1CVE-2026-97263EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  46. 7.1CVE-2026-102388EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

  47. 6.4CVE-2026-4791EPSS 0.2%

    The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitizati…

  48. 7.2CVE-2026-107657EPSS 0.2%

    The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and inc…

  49. 6.4CVE-2026-97396EPSS 0.2%

    The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization an…

  50. 6.4CVE-2026-97340EPSS 0.2%

    The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin…