cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 25

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-39727EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

  2. 7.1CVE-2026-39726EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

  3. 7.1CVE-2026-39724EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

  4. 7.1CVE-2026-39722EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

  5. 7.1CVE-2026-39720EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

  6. 7.1CVE-2026-32577EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

  7. 7.1CVE-2026-32575EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

  8. 7.1CVE-2026-32574EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

  9. 7.1CVE-2026-32572EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

  10. 6.5CVE-2026-32571EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

  11. 7.1CVE-2026-32570EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

  12. 7.1CVE-2026-32569EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

  13. 6.5CVE-2026-105879EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.…

  14. 2.1CVE-2026-105809EPSS 0.3%

    A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname…

  15. 2.0CVE-2026-105808EPSS 0.3%

    A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site …

  16. 7.1CVE-2026-105061EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

  17. 7.1CVE-2026-104814EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

  18. 7.1CVE-2026-104672EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

  19. 7.1CVE-2026-104670EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

  20. 7.1CVE-2026-104395EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

  21. 7.1CVE-2026-104394EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

  22. 7.1CVE-2026-103346EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a throu…

  23. 7.2CVE-2026-75962EPSS 0.3%

    The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and i…

  24. 7.1CVE-2026-39760EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

  25. 2.1CVE-2026-105708EPSS 0.3%

    A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is…

  26. 2.1CVE-2026-105705EPSS 0.3%

    A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to be …

  27. 4.6CVE-2026-105784EPSS 0.2%

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-d…

  28. 5.4CVE-2026-105694EPSS 0.2%

    Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitizati…

  29. 7.3CVE-2026-105679EPSS 0.2%

    Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restrict…

  30. 7.3CVE-2026-105651EPSS 0.3%

    Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, includi…

  31. 8.1CVE-2026-105650EPSS 0.3%

    Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the …

  32. 7.3CVE-2026-105649EPSS 0.3%

    Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to ho…

  33. 5.4CVE-2026-95166EPSS 0.2%

    In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.

  34. 6.1CVE-2026-95165EPSS 0.2%

    Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.

  35. 6.8CVE-2026-105644EPSS 0.3%

    Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the s…

  36. 7.3CVE-2026-105643EPSS 0.3%

    Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in po…

  37. 7.1CVE-2026-100515EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/…

  38. 6.5CVE-2026-100509EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.

  39. 6.5CVE-2026-42700EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

  40. 8.7CVE-2026-105630EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlle…

  41. 8.7CVE-2026-104979EPSS 0.4%

    Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated us…

  42. 4.2CVE-2026-102576EPSS 0.3%

    A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw…

  43. 5.4CVE-2026-102295EPSS 0.2%

    A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a …

  44. 7.1CVE-2025-15643EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

  45. 5.1CVE-2026-105397EPSS 0.2%

    LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role …

  46. 5.3CVE-2026-102426EPSS 0.2%

    Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the del…

  47. 5.7CVE-2026-59788EPSS 0.3%

    The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an i…

  48. 2.1CVE-2026-105291EPSS 0.3%

    A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint.…

  49. 2.0CVE-2026-105289EPSS 0.2%

    A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Perform…

  50. 2.1CVE-2026-105288EPSS 0.3%

    A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the ar…