cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 81

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.4CVE-2026-8351EPSS 0.4%

    The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping on the 'backgrou…

  2. 6.4CVE-2026-9626EPSS 0.4%

    The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the …

  3. 6.4CVE-2026-8892EPSS 0.3%

    The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanit…

  4. 6.4CVE-2026-8489EPSS 0.4%

    The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'about_me' parameter in all versions up to, and in…

  5. 7.2CVE-2026-13040EPSS 0.5%

    The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and out…

  6. 6.4CVE-2026-12734EPSS 0.3%

    The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insuffi…

  7. 6.4CVE-2026-12731EPSS 0.3%

    The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and includi…

  8. 4.8CVE-2026-13377EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-202…

  9. 4.8CVE-2026-13376EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2…

  10. 4.8CVE-2026-13375EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated…

  11. 4.8CVE-2026-13374EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitiga…

  12. 4.8CVE-2026-13373EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated…

  13. 2.1CVE-2026-59102EPSS 0.3%

    Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Act…

  14. 5.1CVE-2026-58579EPSS 0.3%

    RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name ve…

  15. 5.1CVE-2025-71385EPSS 0.4%

    Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the respons…

  16. 7.0CVE-2026-8699EPSS 0.3%

    A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input i…

  17. 5.4CVE-2026-4772EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

  18. 4.6CVE-2026-4770EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 be…

  19. 6.5CVE-2026-57764EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

  20. 6.5CVE-2026-57763EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

  21. 5.9CVE-2026-57762EPSS 0.2%

    Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

  22. 6.5CVE-2026-57755EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

  23. 6.5CVE-2026-57754EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.

  24. 7.1CVE-2026-57686EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

  25. 6.5CVE-2026-57684EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

  26. 7.1CVE-2026-57682EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

  27. 7.1CVE-2026-57678EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

  28. 7.1CVE-2026-57675EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

  29. 7.1CVE-2026-57674EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

  30. 7.1CVE-2026-57673EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

  31. 7.1CVE-2026-57672EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

  32. 7.1CVE-2026-57671EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

  33. 7.1CVE-2026-57670EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

  34. 9.6CVE-2026-57625EPSS 0.4%

    Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

  35. 7.1CVE-2026-57426EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

  36. 7.1CVE-2026-57366EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

  37. 7.1CVE-2026-57362EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

  38. 7.1CVE-2026-57361EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

  39. 7.1CVE-2026-57360EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

  40. 7.1CVE-2026-57359EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

  41. 7.1CVE-2026-57358EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

  42. 7.1CVE-2026-57357EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

  43. 7.1CVE-2026-57356EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

  44. 6.5CVE-2026-57354EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

  45. 7.1CVE-2026-57351EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

  46. 7.1CVE-2026-57350EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

  47. 7.1CVE-2026-57349EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

  48. 7.1CVE-2026-57345EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

  49. 7.1CVE-2026-57344EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

  50. 7.1CVE-2026-57343EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.