cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 72

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-61944EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

  2. 7.1CVE-2026-59517EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

  3. 6.5CVE-2026-59513EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

  4. 7.1CVE-2026-59512EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

  5. 7.1CVE-2026-57809EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

  6. 7.1CVE-2026-57769EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

  7. 7.1CVE-2026-57767EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

  8. 7.1CVE-2026-57735EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

  9. 7.1CVE-2026-57704EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

  10. 7.1CVE-2026-57701EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

  11. 7.1CVE-2026-57699EPSS 0.3%

    Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

  12. 7.1CVE-2026-57428EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.

  13. 7.1CVE-2026-57427EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

  14. 7.1CVE-2026-57397EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

  15. 6.5CVE-2026-57384EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.

  16. 7.1CVE-2026-57374EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.

  17. 6.5CVE-2026-57373EPSS 0.2%

    Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

  18. 7.1CVE-2026-57370EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

  19. 6.5CVE-2026-27403EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

  20. 5.9CVE-2026-24628EPSS 0.2%

    Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

  21. 5.9CVE-2025-68081EPSS 0.2%

    Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.

  22. 6.1CVE-2026-65756EPSS 0.3%

    Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.

  23. 6.4CVE-2026-15794EPSS 0.3%

    The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping.…

  24. 4.4CVE-2026-15647EPSS 0.3%

    The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. Thi…

  25. 6.4CVE-2026-15646EPSS 0.3%

    The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes…

  26. 6.4CVE-2026-15404EPSS 0.3%

    The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery_add_filter_text_templa…

  27. 6.4CVE-2026-15394EPSS 0.3%

    The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitiz…

  28. 6.4CVE-2026-14481EPSS 0.4%

    The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insuffici…

  29. 6.4CVE-2026-9729EPSS 0.3%

    The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters in versions up to, and including, 4.39.0. This is due to in…

  30. 6.4CVE-2026-9635EPSS 0.3%

    The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and…

  31. 7.2CVE-2026-12421EPSS 0.3%

    The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for un…

  32. 4.8CVE-2026-9577EPSS 0.2%

    The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site…

  33. 6.1CVE-2026-9066EPSS 0.3%

    The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a …

  34. 7.2CVE-2026-7534EPSS 0.3%

    The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` fil…

  35. 7.2CVE-2026-7232EPSS 0.3%

    The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it pos…

  36. 5.4CVE-2026-64795EPSS 0.2%

    Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A conten…

  37. 4.8CVE-2026-63281EPSS 0.2%

    Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries.

  38. 5.3CVE-2026-64828EPSS 0.4%

    Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft ma…

  39. 9.3CVE-2026-8152EPSS 0.4%

    Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the …

  40. 8.2CVE-2026-65597EPSS 0.3%

    n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass a…

  41. 8.4CVE-2026-65592EPSS 0.2%

    n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. A…

  42. 5.3CVE-2026-63264EPSS 0.4%

    Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.

  43. 6.4CVE-2026-15787EPSS 0.4%

    The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient inpu…

  44. 8.8CVE-2026-12968EPSS 0.5%

    The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attack…

  45. 2.1CVE-2026-16486EPSS 0.5%

    A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiat…

  46. 2.1CVE-2026-16485EPSS 0.5%

    A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The a…

  47. 8.8CVE-2026-60664EPSS 0.2%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated at…

  48. 8.0CVE-2026-60650EPSS 0.2%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privil…

  49. 8.0CVE-2026-60646EPSS 0.2%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privil…

  50. 8.8CVE-2026-60639EPSS 0.2%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated at…