cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 40

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-90986EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

  2. 7.1CVE-2026-90887EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

  3. 6.5CVE-2026-78294EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

  4. 6.5CVE-2026-66617EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

  5. 6.5CVE-2026-66579EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

  6. 6.5CVE-2026-66578EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

  7. 6.5CVE-2026-66577EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

  8. 6.5CVE-2026-66576EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

  9. 6.5CVE-2026-66574EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.

  10. 6.5CVE-2026-66573EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.

  11. 6.5CVE-2026-66572EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.

  12. 7.1CVE-2026-91014EPSS 0.3%

    The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in…

  13. 6.8CVE-2026-91011EPSS 0.4%

    The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is sto…

  14. 8.8CVE-2026-88792EPSS 0.5%

    The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a …

  15. 8.8CVE-2026-87786EPSS 0.5%

    The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an adm…

  16. 6.8CVE-2026-86788EPSS 0.4%

    The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access …

  17. 8.8CVE-2026-85130EPSS 0.5%

    The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrar…

  18. 7.1CVE-2025-15697EPSS 0.3%

    The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks …

  19. 6.4CVE-2026-86311EPSS 0.3%

    The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization a…

  20. 5.1CVE-2026-92590EPSS 0.2%

    Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaSc…

  21. 5.3CVE-2026-92584EPSS 0.3%

    AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's U…

  22. 5.1CVE-2026-61597EPSS 0.4%

    djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-…

  23. 2.3CVE-2026-92814EPSS 0.3%

    changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like emai…

  24. 6.1CVE-2026-20309EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. This…

  25. 2.0CVE-2026-92418EPSS 0.3%

    A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoi…

  26. 6.1CVE-2026-88593EPSS 0.3%

    kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates…

  27. 5.4CVE-2026-84397EPSS 0.6%

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a …

  28. 7.3CVE-2026-85386EPSS 0.2%

    Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served i…

  29. 7.7CVE-2026-85385EPSS 0.5%

    Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged…

  30. 1.9CVE-2026-92385EPSS 0.4%

    A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of the component Category Update. The manipulation leads to cross site scr…

  31. 2.0CVE-2026-92381EPSS 0.3%

    A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title c…

  32. 6.1CVE-2026-88976EPSS 0.3%

    Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an appli…

  33. 8.1CVE-2026-63671EPSS 0.5%

    MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and u…

  34. 6.8CVE-2026-92140EPSS 0.4%

    Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger b…

  35. 8.0CVE-2026-92136EPSS 0.4%

    Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure…

  36. 8.0CVE-2026-92135EPSS 0.4%

    Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme UR…

  37. 8.0CVE-2026-92134EPSS 0.4%

    Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: sche…

  38. 6.3CVE-2026-73169EPSS 0.5%

    Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06…

  39. 6.1CVE-2026-78252EPSS 0.3%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform u…

  40. 4.7CVE-2026-19619EPSS 0.3%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScr…

  41. 6.8CVE-2026-86784EPSS 0.4%

    The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that …

  42. 7.1CVE-2026-86444EPSS 0.3%

    The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who open…

  43. 8.8CVE-2026-84829EPSS 0.5%

    The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, …

  44. 6.8CVE-2026-84088EPSS 0.4%

    The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above …

  45. 6.8CVE-2026-76558EPSS 0.4%

    The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contribut…

  46. 6.4CVE-2026-5920EPSS 0.3%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable securit…

  47. 6.1CVE-2026-18555EPSS 0.3%

    The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient in…

  48. 7.2CVE-2026-18595EPSS 0.3%

    The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. T…

  49. 6.4CVE-2026-11996EPSS 0.3%

    The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes i…

  50. 5.1CVE-2026-92214EPSS 0.3%

    A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-cha…