cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 70

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.1CVE-2026-66029EPSS 0.3%

    Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field o…

  2. 8.6CVE-2026-59239EPSS 0.7%

    Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leadi…

  3. 6.1CVE-2026-66390EPSS 0.6%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrad…

  4. 9.3CVE-2026-66396EPSS 0.5%

    SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor perm…

  5. 9.4CVE-2026-66395EPSS 0.6%

    SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML…

  6. 9.3CVE-2026-66394EPSS 0.3%

    SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags w…

  7. 5.9CVE-2026-66475EPSS 0.2%

    Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versions.

  8. 6.5CVE-2026-66448EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

  9. 6.5CVE-2026-66445EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

  10. 6.5CVE-2026-66434EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

  11. 6.5CVE-2026-66433EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

  12. 5.9CVE-2026-65563EPSS 0.2%

    Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

  13. 6.5CVE-2026-65562EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

  14. 6.5CVE-2026-65561EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

  15. 5.9CVE-2026-65557EPSS 0.2%

    Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

  16. 6.5CVE-2026-59559EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

  17. 7.1CVE-2026-59558EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

  18. 7.1CVE-2026-59556EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

  19. 7.1CVE-2026-59553EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

  20. 6.3CVE-2026-14856EPSS 0.4%

    A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can …

  21. 5.1CVE-2026-65764EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

  22. 6.8CVE-2026-14827EPSS 0.4%

    The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript…

  23. 4.8CVE-2026-14203EPSS 0.2%

    The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes…

  24. 6.1CVE-2026-14190EPSS 0.3%

    The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated atta…

  25. 7.1CVE-2026-13726EPSS 0.3%

    The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send…

  26. 6.1CVE-2026-13400EPSS 0.3%

    Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back int…

  27. 6.1CVE-2026-12982EPSS 0.3%

    The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability whic…

  28. 6.1CVE-2026-10082EPSS 0.3%

    The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the …

  29. 8.2CVE-2026-15928EPSS 0.3%

    XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

  30. 8.1CVE-2026-17496EPSS 0.5%

    NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-contro…

  31. 6.4CVE-2026-15425EPSS 0.3%

    The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitizat…

  32. 5.1CVE-2026-57531EPSS 0.4%

    Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to pa…

  33. 5.1CVE-2026-57530EPSS 0.3%

    Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browse…

  34. 6.1CVE-2026-8308EPSS 0.3%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2.

  35. 8.7CVE-2026-55730EPSS 0.6%

    Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privi…

  36. 8.7CVE-2026-12496EPSS 0.6%

    Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary J…

  37. 5.1CVE-2026-66010EPSS 0.2%

    DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attribu…

  38. 8.7CVE-2026-15810EPSS 0.5%

    A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaS…

  39. 7.2CVE-2026-15401EPSS 0.6%

    The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. T…

  40. 6.4CVE-2026-15821EPSS 0.3%

    The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output …

  41. 6.4CVE-2026-15739EPSS 0.4%

    The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escap…

  42. 6.1CVE-2026-15346EPSS 0.5%

    The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output e…

  43. 6.4CVE-2026-15755EPSS 0.4%

    The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping…

  44. 6.4CVE-2026-15665EPSS 0.3%

    The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sa…

  45. 6.4CVE-2026-15653EPSS 0.3%

    The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input s…

  46. 6.4CVE-2026-15648EPSS 0.3%

    The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes…

  47. 6.4CVE-2026-15464EPSS 0.3%

    The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This mak…

  48. 6.4CVE-2026-15334EPSS 0.4%

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2…

  49. 6.4CVE-2026-15333EPSS 0.4%

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including…

  50. 6.4CVE-2026-6454EPSS 0.4%

    The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad…