cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 52

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-84192EPSS 0.3%

    LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary…

  2. 5.3CVE-2026-84191EPSS 0.3%

    LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers …

  3. 9.2CVE-2026-84189EPSS 0.4%

    LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An admini…

  4. 4.8CVE-2026-84188EPSS 0.3%

    LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator …

  5. 7.2CVE-2026-19914EPSS 0.5%

    The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes i…

  6. 6.4CVE-2026-16788EPSS 0.3%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitizat…

  7. 6.4CVE-2026-16786EPSS 0.3%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanit…

  8. 6.4CVE-2026-15101EPSS 0.3%

    The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it poss…

  9. 6.4CVE-2026-75980EPSS 0.3%

    The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due t…

  10. 6.1CVE-2026-75964EPSS 0.4%

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to i…

  11. 6.4CVE-2026-18488EPSS 0.4%

    The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output esc…

  12. 6.4CVE-2026-75965EPSS 0.3%

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due…

  13. 7.2CVE-2026-19796EPSS 0.4%

    The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient in…

  14. 7.2CVE-2026-19573EPSS 0.4%

    The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. …

  15. 6.4CVE-2026-16787EPSS 0.3%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and …

  16. 6.4CVE-2026-13203EPSS 0.4%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, an…

  17. 6.4CVE-2026-12747EPSS 0.3%

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This…

  18. 5.4CVE-2026-82396EPSS 0.3%

    Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its …

  19. 7.1CVE-2026-82229EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

  20. 7.1CVE-2026-82224EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

  21. 7.1CVE-2026-82221EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

  22. 5.1CVE-2026-81887EPSS 0.7%

    Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __pro…

  23. 6.5CVE-2026-81778EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

  24. 7.1CVE-2026-81768EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

  25. 7.1CVE-2026-81765EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

  26. 7.1CVE-2026-81764EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

  27. 7.1CVE-2026-81298EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

  28. 7.1CVE-2026-81291EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

  29. 7.1CVE-2026-81290EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

  30. 4.4CVE-2026-54179EPSS 0.3%

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/Sing…

  31. 6.1CVE-2025-63607EPSS 0.3%

    TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

  32. 2.1CVE-2026-82805EPSS 0.5%

    A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be …

  33. 5.4CVE-2026-51153EPSS 0.2%

    Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Pytho…

  34. 2.1CVE-2026-82700EPSS 0.5%

    A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email …

  35. 8.6CVE-2026-78077EPSS 0.4%

    Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were re…

  36. 6.1CVE-2026-76986EPSS 0.6%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no…

  37. 5.1CVE-2026-76985EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display…

  38. 5.1CVE-2026-76984EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values …

  39. 5.1CVE-2026-76983EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The reso…

  40. 5.1CVE-2026-76982EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — …

  41. 5.1CVE-2026-75802EPSS 0.5%

    AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for …

  42. 5.1CVE-2026-82881EPSS 0.3%

    Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat respon…

  43. 5.3CVE-2026-82868EPSS 0.3%

    @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts,…

  44. 5.3CVE-2026-82867EPSS 0.3%

    @pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with cra…

  45. 2.1CVE-2026-82865EPSS 0.2%

    pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inj…

  46. 2.1CVE-2026-82664EPSS 0.6%

    A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Se…

  47. 2.1CVE-2026-82625EPSS 0.5%

    A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripti…

  48. 2.0CVE-2026-82622EPSS 0.3%

    A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argu…

  49. 5.4CVE-2026-40464EPSS 0.2%

    NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when anot…

  50. 8.4CVE-2026-77850EPSS 0.5%

    Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and…