cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 71

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.4CVE-2026-15333EPSS 0.4%

    The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including…

  2. 6.4CVE-2026-6454EPSS 0.4%

    The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad…

  3. 6.4CVE-2026-15100EPSS 0.3%

    The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output es…

  4. 6.4CVE-2025-9205EPSS 0.3%

    The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map option…

  5. 5.4CVE-2026-15968EPSS 0.3%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

  6. 5.1CVE-2026-65763EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.

  7. 5.1CVE-2026-65762EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

  8. 8.7CVE-2026-47743EPSS 0.4%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel expos…

  9. 5.1CVE-2026-65697EPSS 0.3%

    Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostn…

  10. 5.1CVE-2026-48539EPSS 0.2%

    GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /…

  11. 5.1CVE-2026-48538EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to …

  12. 5.1CVE-2026-48537EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to …

  13. 5.1CVE-2026-48536EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /…

  14. 5.1CVE-2026-48535EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to…

  15. 5.1CVE-2026-48534EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServer…

  16. 5.1CVE-2026-48532EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /…

  17. 5.1CVE-2026-48531EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/Rete…

  18. 5.1CVE-2026-48530EPSS 0.2%

    GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parame…

  19. 5.3CVE-2026-65914EPSS 0.3%

    DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloa…

  20. 5.1CVE-2026-65912EPSS 0.3%

    DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag com…

  21. 5.1CVE-2026-65911EPSS 0.3%

    In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the sa…

  22. 5.1CVE-2026-65901EPSS 0.3%

    DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observabl…

  23. 5.1CVE-2026-65900EPSS 0.3%

    DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) insi…

  24. 5.1CVE-2026-65898EPSS 0.2%

    DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally a…

  25. 9.4CVE-2026-65606EPSS 0.8%

    SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the…

  26. 9.4CVE-2026-65605EPSS 0.8%

    SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when…

  27. 5.9CVE-2026-65550EPSS 0.2%

    Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

  28. 5.9CVE-2026-65538EPSS 0.2%

    Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

  29. 5.9CVE-2026-65534EPSS 0.2%

    Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

  30. 6.5CVE-2026-65533EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

  31. 6.5CVE-2026-65528EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

  32. 6.5CVE-2026-65527EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

  33. 6.5CVE-2026-65522EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  34. 6.5CVE-2026-65519EPSS 0.2%

    Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

  35. 6.5CVE-2026-65518EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

  36. 6.5CVE-2026-65514EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

  37. 7.1CVE-2026-65511EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  38. 7.1CVE-2026-65510EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  39. 6.5CVE-2026-65503EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  40. 7.1CVE-2026-65492EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

  41. 5.9CVE-2026-65483EPSS 0.2%

    Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

  42. 6.5CVE-2026-65482EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elem…

  43. 6.5CVE-2026-65480EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.

  44. 6.5CVE-2026-65475EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

  45. 6.5CVE-2026-65473EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

  46. 6.5CVE-2026-65470EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

  47. 6.5CVE-2026-65465EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

  48. 6.5CVE-2026-65449EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

  49. 6.1CVE-2026-64810EPSS 0.3%

    In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

  50. 7.1CVE-2026-61947EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.