cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 84

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-57320EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.

  2. 2.0CVE-2026-13570EPSS 0.3%

    A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the component User Registration Endpoint. Performing a manipulation of the argument full_…

  3. 2.1CVE-2026-13567EPSS 0.5%

    A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmess…

  4. 2.0CVE-2026-13558EPSS 0.3%

    A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Ti…

  5. 2.1CVE-2026-13557EPSS 0.5%

    A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/mod_room/controller.php?action=add of the component POST Request Handler. Such manipulation of th…

  6. 2.1CVE-2026-13556EPSS 0.5%

    A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?action=edit of the component POST Request Handler. This manipulation of the argumen…

  7. 2.1CVE-2026-13554EPSS 0.5%

    A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/mod_amenities/controller.php?action=add of the component POST Request Handler.…

  8. 2.1CVE-2026-13536EPSS 0.4%

    A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn leads to cross site scripting. The attack may be initiated remotely. The exploit ha…

  9. 2.0CVE-2026-13504EPSS 0.3%

    A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component Mail Compose Page. Such manipulation leads to cross site scripting. The attack ma…

  10. 2.1CVE-2026-13499EPSS 0.5%

    A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file login_register.php of the component Registration Handler. Performing a manipulation of the argument Username…

  11. 6.4CVE-2026-13295EPSS 0.4%

    The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes …

  12. 4.4CVE-2026-12399EPSS 0.4%

    The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and outpu…

  13. 6.4CVE-2026-11783EPSS 0.4%

    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Product SKU in all versions up to, and including, 5.0.4 due to ins…

  14. 6.4CVE-2026-11597EPSS 0.3%

    The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output …

  15. 6.1CVE-2026-13245EPSS 0.4%

    The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This make…

  16. 6.4CVE-2026-13335EPSS 0.4%

    The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. Thi…

  17. 4.4CVE-2026-11356EPSS 0.4%

    The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input saniti…

  18. 5.4CVE-2026-50767EPSS 0.3%

    A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web …

  19. 5.4CVE-2026-50766EPSS 0.3%

    A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via…

  20. 6.1CVE-2026-50765EPSS 0.3%

    A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject …

  21. 6.4CVE-2026-52781EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* attributes via :data wildcard. An attacker injects data-controller="poll-for-chan…

  22. 5.7CVE-2026-44696EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essent…

  23. 5.9CVE-2026-57656EPSS 0.2%

    Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

  24. 6.5CVE-2026-57651EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

  25. 6.5CVE-2026-57650EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

  26. 6.5CVE-2026-57638EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

  27. 6.5CVE-2026-57629EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

  28. 6.5CVE-2026-57618EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

  29. 6.5CVE-2026-57617EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

  30. 6.5CVE-2026-57431EPSS 0.2%

    Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

  31. 7.1CVE-2026-57325EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

  32. 7.1CVE-2026-57322EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.

  33. 7.1CVE-2026-57319EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

  34. 7.1CVE-2026-57317EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

  35. 7.1CVE-2026-57314EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

  36. 6.5CVE-2026-57313EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

  37. 7.1CVE-2026-57312EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

  38. 7.1CVE-2026-56072EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.

  39. 7.1CVE-2026-56047EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

  40. 6.5CVE-2026-56046EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

  41. 7.1CVE-2026-56045EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

  42. 7.1CVE-2026-56044EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

  43. 7.1CVE-2026-56043EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.

  44. 7.1CVE-2026-56041EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.

  45. 7.1CVE-2026-56040EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

  46. 7.1CVE-2026-56039EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

  47. 7.1CVE-2026-56011EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.

  48. 6.5CVE-2025-68075EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

  49. 6.5CVE-2025-68074EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

  50. 6.5CVE-2026-57620EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.