cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 30

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-102092EPSS 0.3%

    Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they pre…

  2. 7.1CVE-2026-97290EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

  3. 6.5CVE-2026-97265EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

  4. 7.1CVE-2026-94171EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

  5. 7.1CVE-2026-102391EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.

  6. 7.1CVE-2026-102376EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

  7. 7.1CVE-2026-100510EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.

  8. 4.8CVE-2026-100275EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

  9. 6.1CVE-2026-100263EPSS 0.2%

    In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

  10. 6.5CVE-2026-62084EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

  11. 6.2CVE-2026-103389EPSS 0.3%

    MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endp…

  12. 6.2CVE-2026-103388EPSS 0.2%

    MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor pri…

  13. 6.5CVE-2026-97301EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

  14. 6.5CVE-2026-97298EPSS 0.1%

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

  15. 6.5CVE-2026-97292EPSS 0.1%

    Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

  16. 7.1CVE-2026-97289EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2…

  17. 6.5CVE-2026-97288EPSS 0.1%

    Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

  18. 6.5CVE-2026-97286EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

  19. 6.5CVE-2026-97279EPSS 0.1%

    Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

  20. 7.1CVE-2026-97272EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

  21. 7.1CVE-2026-97271EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  22. 6.5CVE-2026-97270EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

  23. 6.5CVE-2026-97266EPSS 0.1%

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

  24. 6.5CVE-2026-97262EPSS 0.1%

    Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

  25. 7.1CVE-2026-97253EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

  26. 7.1CVE-2026-97250EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

  27. 5.5CVE-2026-97238EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

  28. 7.1CVE-2026-97237EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

  29. 6.5CVE-2026-97236EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

  30. 7.1CVE-2026-97235EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

  31. 7.1CVE-2026-97077EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

  32. 6.5CVE-2026-97067EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

  33. 7.1CVE-2026-97065EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

  34. 7.1CVE-2026-96836EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

  35. 6.5CVE-2026-96835EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

  36. 7.1CVE-2026-96830EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

  37. 6.5CVE-2026-96829EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

  38. 7.1CVE-2026-96820EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

  39. 7.1CVE-2026-96819EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

  40. 7.1CVE-2026-96816EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

  41. 7.1CVE-2026-96814EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

  42. 5.4CVE-2026-96450EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

  43. 7.1CVE-2026-96352EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

  44. 7.1CVE-2026-96351EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

  45. 6.5CVE-2026-96338EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

  46. 6.5CVE-2026-94674EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

  47. 7.1CVE-2026-94081EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

  48. 7.1CVE-2026-94078EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

  49. 6.5CVE-2026-94077EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

  50. 7.1CVE-2026-93770EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.