cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 31

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-93514EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

  2. 7.1CVE-2026-93512EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

  3. 6.5CVE-2026-62080EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

  4. 6.5CVE-2026-62079EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

  5. 6.5CVE-2026-62078EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

  6. 7.1CVE-2026-27371EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  7. 8.3CVE-2026-103321EPSS 0.4%

    MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered…

  8. 7.1CVE-2026-102398EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

  9. 7.1CVE-2026-102396EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

  10. 7.1CVE-2026-102395EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

  11. 6.5CVE-2026-102386EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.

  12. 7.1CVE-2026-102385EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

  13. 5.9CVE-2026-102384EPSS 0.2%

    Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

  14. 6.5CVE-2026-100513EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versions.

  15. 7.1CVE-2026-100507EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personali…

  16. 7.2CVE-2026-97347EPSS 0.3%

    The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it poss…

  17. 6.4CVE-2026-93908EPSS 0.2%

    The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input san…

  18. 6.4CVE-2026-92712EPSS 0.2%

    The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output e…

  19. 6.1CVE-2026-102586EPSS 0.3%

    A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted…

  20. 5.4CVE-2026-102581EPSS 0.2%

    A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes ar…

  21. 5.1CVE-2026-102459EPSS 0.2%

    EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.

  22. 6.4CVE-2025-14564EPSS 0.2%

    The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it poss…

  23. 5.1CVE-2026-93464EPSS 0.1%

    A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

  24. 5.1CVE-2026-93463EPSS 0.2%

    A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

  25. 5.1CVE-2026-93460EPSS 0.1%

    A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

  26. 6.4CVE-2026-88037EPSS 0.2%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization …

  27. 6.4CVE-2026-6173EPSS 0.2%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sani…

  28. 6.4CVE-2026-6172EPSS 0.2%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization an…

  29. 6.4CVE-2026-6171EPSS 0.2%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and …

  30. 6.4CVE-2026-6170EPSS 0.2%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitiz…

  31. 6.4CVE-2026-14876EPSS 0.2%

    The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it pos…

  32. 6.4CVE-2026-11895EPSS 0.2%

    The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insuffici…

  33. 8.8CVE-2026-92994EPSS 0.3%

    The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated …

  34. 6.8CVE-2026-92424EPSS 0.2%

    The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting…

  35. 7.1CVE-2026-91832EPSS 0.09%

    The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an adminis…

  36. 7.5CVE-2026-89193EPSS 0.2%

    The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit conte…

  37. 6.8CVE-2026-87777EPSS 0.2%

    The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will e…

  38. 8.8CVE-2026-85573EPSS 0.3%

    The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store f…

  39. 6.8CVE-2026-85415EPSS 0.2%

    The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in t…

  40. 6.8CVE-2026-85001EPSS 0.2%

    The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web…

  41. 3.5CVE-2026-82127EPSS 0.1%

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to injec…

  42. 7.2CVE-2026-96649EPSS 0.2%

    The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including…

  43. 2.1CVE-2026-102847EPSS 0.3%

    A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. T…

  44. 6.1CVE-2026-103051EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: …

  45. 6.1CVE-2026-103050EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: befo…

  46. 6.1CVE-2026-103049EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.

  47. 6.1CVE-2026-103047EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: befo…

  48. 6.1CVE-2026-103046EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.4…

  49. 6.1CVE-2026-103045EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.4…

  50. 7.7CVE-2026-84409EPSS 0.4%

    The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response,…