cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 59

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2026-18202EPSS 0.4%

    The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicio…

  2. 8.8CVE-2026-16617EPSS 0.5%

    The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to per…

  3. 7.1CVE-2026-16570EPSS 0.3%

    The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks…

  4. 6.8CVE-2026-15253EPSS 0.4%

    The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitr…

  5. 8.8CVE-2026-14334EPSS 0.5%

    The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking Sys…

  6. 4.7CVE-2026-14287EPSS 0.2%

    The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing a…

  7. 5.1CVE-2026-66358EPSS 0.3%

    A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

  8. 6.4CVE-2026-15421EPSS 0.4%

    The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization …

  9. 6.5CVE-2026-66591EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.

  10. 5.9CVE-2026-27365EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

  11. 6.5CVE-2026-66603EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.

  12. 6.9CVE-2026-52873EPSS 0.4%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registe…

  13. 8.6CVE-2026-52854EPSS 0.6%

    Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays par…

  14. 9.3CVE-2026-21580EPSS 0.5%

    This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, …

  15. 8.7CVE-2026-54347EPSS 0.4%

    Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content f…

  16. 5.1CVE-2026-41921EPSS 0.3%

    Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through …

  17. 6.7CVE-2025-9211EPSS 0.5%

    Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

  18. 6.3CVE-2026-61696EPSS 0.3%

    Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/vi…

  19. 6.1CVE-2026-52609EPSS 0.3%

    A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in con…

  20. 5.1CVE-2026-73336EPSS 0.3%

    Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.

  21. 6.1CVE-2026-52606EPSS 0.3%

    A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjuncti…

  22. 6.1CVE-2026-30250EPSS 0.4%

    Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code

  23. 8.7CVE-2026-55839EPSS 0.4%

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScr…

  24. 8.7CVE-2026-45116EPSS 0.4%

    MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fiel…

  25. 8.7CVE-2026-45115EPSS 0.4%

    MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy…

  26. 4.6CVE-2026-73426EPSS 0.3%

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can cr…

  27. 7.1CVE-2026-73393EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

  28. 7.1CVE-2026-73382EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.

  29. 7.1CVE-2026-73378EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

  30. 7.1CVE-2026-73375EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

  31. 7.1CVE-2026-73362EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

  32. 7.1CVE-2026-73361EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

  33. 7.1CVE-2026-73360EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

  34. 6.5CVE-2026-73359EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

  35. 7.1CVE-2026-73358EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

  36. 7.1CVE-2026-73351EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

  37. 7.1CVE-2026-73342EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

  38. 7.1CVE-2026-73338EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

  39. 7.1CVE-2026-73190EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7…

  40. 7.1CVE-2026-68567EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a thr…

  41. 6.5CVE-2026-68565EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

  42. 7.1CVE-2026-66667EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

  43. 6.5CVE-2026-66646EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

  44. 6.5CVE-2026-66645EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

  45. 6.5CVE-2026-66644EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

  46. 6.5CVE-2026-66643EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

  47. 6.5CVE-2026-66641EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

  48. 6.5CVE-2026-66640EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

  49. 6.5CVE-2026-66639EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

  50. 6.5CVE-2026-66638EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.