cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 65

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2024-39024EPSS 0.8%

    In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

  2. 7.1CVE-2026-66711EPSS 0.3%

    Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

  3. 7.1CVE-2026-66707EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

  4. 5.9CVE-2026-66706EPSS 0.2%

    Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

  5. 7.1CVE-2026-66705EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.

  6. 6.5CVE-2026-66703EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

  7. 7.1CVE-2026-66702EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

  8. 7.1CVE-2026-66694EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.

  9. 7.1CVE-2026-66690EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

  10. 6.5CVE-2026-66688EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.

  11. 7.1CVE-2026-66664EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

  12. 7.1CVE-2026-66663EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

  13. 7.1CVE-2026-66457EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

  14. 7.1CVE-2026-66440EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.

  15. 7.1CVE-2026-66439EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

  16. 7.1CVE-2026-65565EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

  17. 7.1CVE-2026-65560EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

  18. 7.1CVE-2026-65545EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  19. 7.1CVE-2026-65544EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  20. 7.1CVE-2026-65517EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  21. 7.1CVE-2026-65515EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  22. 7.1CVE-2026-65513EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  23. 7.1CVE-2026-65509EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  24. 7.1CVE-2026-61982EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

  25. 7.1CVE-2026-61964EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

  26. 7.1CVE-2026-61963EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

  27. 7.1CVE-2026-61961EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

  28. 6.5CVE-2026-61959EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.

  29. 5.9CVE-2026-28179EPSS 0.2%

    Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

  30. 6.5CVE-2026-28178EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

  31. 7.1CVE-2026-28177EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

  32. 7.1CVE-2026-28143EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  33. 7.1CVE-2026-28141ExploitEPSS 0.5%

    Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  34. 7.1CVE-2026-28082EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  35. 6.4CVE-2026-18501EPSS 0.3%

    The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and inclu…

  36. 5.4CVE-2026-8166EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.…

  37. 6.4CVE-2026-5391EPSS 0.3%

    The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input s…

  38. 6.4CVE-2026-5158EPSS 0.3%

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficie…

  39. 7.2CVE-2025-15028EPSS 0.3%

    The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to…

  40. 7.2CVE-2026-18510EPSS 0.4%

    The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to in…

  41. 6.4CVE-2026-18400EPSS 0.4%

    The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient …

  42. 5.4CVE-2026-18395EPSS 0.2%

    The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scriptin…

  43. 5.4CVE-2026-16537EPSS 0.2%

    The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting at…

  44. 6.1CVE-2026-11588EPSS 0.3%

    The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-att…

  45. 6.1CVE-2025-15678EPSS 0.3%

    The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that execute…

  46. 7.2CVE-2026-18325EPSS 0.5%

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insuffi…

  47. 7.2CVE-2026-16636EPSS 0.5%

    The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions…

  48. 2.1CVE-2026-18968EPSS 0.4%

    A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scrip…

  49. 5.4CVE-2026-70441EPSS 0.2%

    Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Co…

  50. 5.4CVE-2026-70440EPSS 0.2%

    Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/…