cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 88

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
  • CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
  • CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
  • CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-79, as MITRE names them. Credits.

Ask an AI about CWE-79

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-40720EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions.

  2. 7.1CVE-2025-69140EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

  3. 7.1CVE-2025-68524EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

  4. 7.1CVE-2026-9570EPSS 0.1%

    The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerabili…

  5. 6.4CVE-2026-8607EPSS 0.3%

    The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 d…

  6. 6.4CVE-2026-8494EPSS 0.3%

    The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it…

  7. 7.1CVE-2026-8089ExploitEPSS 0.5%

    The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-no…

  8. 7.1CVE-2026-54195EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

  9. 7.1CVE-2026-54192EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

  10. 7.1CVE-2026-54189EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

  11. 7.1CVE-2026-54188EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

  12. 7.1CVE-2026-49778EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

  13. 7.1CVE-2026-49074EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

  14. 7.1CVE-2026-48869EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

  15. 8.2CVE-2026-48788EPSS 0.3%

    Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. Th…

  16. 6.1CVE-2026-44587EPSS 0.2%

    CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the…

  17. 7.1CVE-2026-42385EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

  18. 7.1CVE-2026-41557EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

  19. 7.1CVE-2026-40765EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.

  20. 7.1CVE-2026-39597EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

  21. 7.1CVE-2026-39548EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

  22. 4.8CVE-2026-27870EPSS 0.3%

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scriptin…

  23. 7.1CVE-2026-22339EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.

  24. 7.1CVE-2026-22329EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.

  25. 7.1CVE-2026-22328EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.

  26. 4.7CVE-2026-12463EPSS 0.1%

    Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium securi…

  27. 6.1CVE-2026-12459EPSS 0.2%

    Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

  28. 6.2CVE-2026-11975EPSS 0.3%

    Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored withou…

  29. 7.1CVE-2025-69151EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

  30. 7.1CVE-2025-69104EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

  31. 7.1CVE-2025-59560EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.

  32. 7.1CVE-2025-31013EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.

  33. 7.1CVE-2024-49269EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

  34. 7.4CVE-2026-48294EPSS 1.9%

    Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session.…

  35. 7.5CVE-2026-46955EPSS 0.2%

    Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network a…

  36. 9.6CVE-2026-46856EPSS 0.5%

    Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticat…

  37. 9.6CVE-2026-46853EPSS 0.5%

    Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticat…

  38. 5.7CVE-2026-12425EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is poss…

  39. 5.4CVE-2024-30476EPSS 0.2%

    PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client …

  40. 7.1CVE-2026-54198EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

  41. 7.1CVE-2026-54191EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

  42. 7.1CVE-2026-39437EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.

  43. 6.4CVE-2026-10093EPSS 0.2%

    The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and …

  44. 6.1CVE-2026-48157EPSS 0.2%

    Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data …

  45. 7.1CVE-2026-52702EPSS 0.1%

    Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

  46. 6.5CVE-2026-49773EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

  47. 7.1CVE-2026-49055EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

  48. 7.1CVE-2026-48966EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

  49. 7.1CVE-2026-48885EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.

  50. 6.5CVE-2026-48880EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.