cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 62

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-66655EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

  2. 6.5CVE-2026-66471EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

  3. 7.1CVE-2026-66468EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

  4. 6.5CVE-2026-66467EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

  5. 6.5CVE-2026-66460EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

  6. 6.5CVE-2026-66456EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

  7. 7.1CVE-2026-66449EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

  8. 7.1CVE-2026-66429EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  9. 7.1CVE-2026-66426EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

  10. 7.1CVE-2026-65580EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

  11. 7.1CVE-2026-61974EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

  12. 7.1CVE-2026-61965EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

  13. 7.1CVE-2026-61960EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

  14. 7.1CVE-2026-28187EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

  15. 6.5CVE-2026-28182EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

  16. 7.1CVE-2026-28175EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

  17. 7.1CVE-2026-28170EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

  18. 7.1CVE-2026-28158EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

  19. 7.1CVE-2026-28004EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

  20. 7.1CVE-2026-28003EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

  21. 7.1CVE-2026-27539EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

  22. 6.5CVE-2026-27537EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

  23. 7.1CVE-2026-27536EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

  24. 5.1CVE-2026-19716EPSS 0.5%

    Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, …

  25. 5.3CVE-2026-73628EPSS 0.3%

    Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode(…

  26. 6.4CVE-2026-3639EPSS 0.3%

    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output…

  27. 7.2CVE-2026-18146EPSS 0.5%

    The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due…

  28. 2.3CVE-2026-73492EPSS 0.4%

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose schem…

  29. 4.7CVE-2026-73490EPSS 0.3%

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on…

  30. 2.1CVE-2026-73427EPSS 0.6%

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback …

  31. 5.3CVE-2026-73422EPSS 0.5%

    Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts.…

  32. 7.5CVE-2026-73415EPSS 0.7%

    jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjec…

  33. 9.2CVE-2026-73329EPSS 0.4%

    CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parame…

  34. 5.1CVE-2026-72787EPSS 0.3%

    Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts c…

  35. 6.5CVE-2026-49466EPSS 0.3%

    Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template…

  36. 6.1CVE-2026-19657EPSS 0.3%

    ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser se…

  37. 5.4CVE-2026-18099EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.

  38. 8.7CVE-2026-15217EPSS 0.5%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization …

  39. 8.7CVE-2026-15216EPSS 0.5%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization …

  40. 9.0CVE-2026-16627EPSS 0.5%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper san…

  41. 5.4CVE-2026-73295EPSS 0.3%

    Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-sit…

  42. 5.1CVE-2026-48552EPSS 0.3%

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing at…

  43. 5.1CVE-2026-48550EPSS 0.4%

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authen…

  44. 5.4CVE-2026-16694EPSS 0.2%

    IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre…

  45. 8.0CVE-2026-65937EPSS 0.4%

    In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

  46. 6.1CVE-2026-73374EPSS 0.6%

    A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] w…

  47. 5.4CVE-2026-73262EPSS 0.3%

    Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML …

  48. 9.3CVE-2026-57858EPSS 0.4%

    Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytic…

  49. 4.8CVE-2026-70560EPSS 0.2%

    Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user f…

  50. 5.4CVE-2026-19217EPSS 0.2%

    The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Sc…