cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 60

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-66637EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

  2. 6.5CVE-2026-66636EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.

  3. 7.1CVE-2026-66633EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

  4. 7.1CVE-2026-66629EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

  5. 7.1CVE-2026-66621EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a…

  6. 8.3CVE-2026-45733EPSS 0.4%

    Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute e…

  7. 7.1CVE-2026-32547EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

  8. 7.1CVE-2026-32333EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

  9. 7.1CVE-2026-28569EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

  10. 7.1CVE-2026-28568EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

  11. 5.1CVE-2026-75838EPSS 0.4%

    DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that exec…

  12. 5.1CVE-2026-75834EPSS 0.3%

    Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byt…

  13. 5.1CVE-2026-75831EPSS 0.4%

    Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowi…

  14. 9.3CVE-2026-75828EPSS 0.4%

    Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like one…

  15. 5.1CVE-2026-75107EPSS 0.2%

    Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML…

  16. 5.1CVE-2026-74908EPSS 0.3%

    Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api…

  17. 9.3CVE-2026-74902EPSS 0.2%

    SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containin…

  18. 9.3CVE-2026-75626EPSS 0.3%

    SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts …

  19. 5.4CVE-2026-19447EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

  20. 7.2CVE-2026-75091EPSS 0.3%

    The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. …

  21. 2.1CVE-2026-75078EPSS 0.5%

    A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exp…

  22. 2.1CVE-2026-75077EPSS 0.5%

    A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. Th…

  23. 7.0CVE-2026-75531EPSS 0.4%

    Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the S…

  24. 6.9CVE-2026-75529EPSS 0.4%

    Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection…

  25. 6.1CVE-2026-67925EPSS 0.4%

    Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload

  26. 6.1CVE-2026-63670EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a lite…

  27. 6.1CVE-2026-50771EPSS 0.3%

    Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.

  28. 8.1CVE-2026-33437EPSS 0.4%

    Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and…

  29. 4.4CVE-2026-75059EPSS 0.2%

    In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

  30. 8.2CVE-2026-75048EPSS 0.3%

    In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

  31. 9.3CVE-2026-55674EPSS 0.6%

    Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTM…

  32. 7.3CVE-2026-13202EPSS 0.4%

    A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2.

  33. 5.4CVE-2026-74999EPSS 0.3%

    In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

  34. 7.2CVE-2026-74998EPSS 0.3%

    In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

  35. 4.8CVE-2026-40126EPSS 0.6%

    OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability ex…

  36. 9.4CVE-2026-74800EPSS 0.4%

    SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute …

  37. 2.1CVE-2026-19998EPSS 0.5%

    A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be perf…

  38. 2.0CVE-2026-19995EPSS 0.3%

    A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scr…

  39. 6.4CVE-2026-2357EPSS 0.3%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on …

  40. 7.2CVE-2026-13424EPSS 0.6%

    The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient in…

  41. 7.2CVE-2026-10734EPSS 0.4%

    The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it poss…

  42. 6.1CVE-2026-19712EPSS 0.3%

    The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cros…

  43. 6.4CVE-2026-18402EPSS 0.3%

    The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient i…

  44. 6.4CVE-2026-16775EPSS 0.3%

    The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input san…

  45. 6.4CVE-2026-16758EPSS 0.3%

    The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possibl…

  46. 6.4CVE-2026-15790EPSS 0.3%

    The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachmen…

  47. 6.4CVE-2026-15604EPSS 0.3%

    The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_serie…

  48. 5.4CVE-2026-13712EPSS 0.2%

    The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run w…

  49. 6.4CVE-2026-15726EPSS 0.3%

    The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it poss…

  50. 6.4CVE-2026-15066EPSS 0.4%

    The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possi…