cve.bz

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

What the weakness is: CWE-80 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-18 XSS Targeting Non-Script Elements Likelihood: High · Severity: Very High
  • CAPEC-32 XSS Through HTTP Query Strings Likelihood: High · Severity: High
  • CAPEC-86 XSS Through HTTP Headers Likelihood: High · Severity: Very High
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-80, as MITRE names them. Credits.

Ask an AI about CWE-80

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/80.html and https://cve.bz/cve/cwe/80?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.1CVE-2026-111040

    The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other use…

  2. 4.3CVE-2026-116858

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.

  3. 5.3CVE-2026-62057EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.

  4. 5.3CVE-2026-52710EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT &#8211; Fre…

  5. 5.3CVE-2026-119479EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

  6. 4.3CVE-2026-42694EPSS 0.2%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

  7. 5.3CVE-2026-48202EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.

  8. 5.3CVE-2026-25467EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

  9. 5.3CVE-2026-116402EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

  10. 6.4CVE-2026-10511EPSS 0.2%

    The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This mak…

  11. 5.3CVE-2026-116394EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.

  12. 2.1CVE-2026-112945EPSS 0.7%

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlF…

  13. 5.4CVE-2026-4418EPSS 0.2%

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of …

  14. 5.4CVE-2026-106151EPSS 0.2%

    In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validati…

  15. 5.4CVE-2026-106149EPSS 0.2%

    In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control thes…

  16. 6.5CVE-2026-106163EPSS 0.2%

    In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-cont…

  17. 4.7CVE-2026-106162EPSS 0.1%

    In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are enc…

  18. 5.4CVE-2026-106161EPSS 0.2%

    In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can mo…

  19. 4.7CVE-2026-106159EPSS 0.2%

    In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button UR…

  20. 4.7CVE-2026-106158EPSS 0.2%

    In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a re…

  21. 4.7CVE-2026-106157EPSS 0.2%

    In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can contr…

  22. 5.4CVE-2026-106148EPSS 0.2%

    In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL…

  23. 5.4CVE-2026-106147EPSS 0.2%

    In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can …

  24. 5.9CVE-2023-54409EPSS 0.2%

    Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by htm…

  25. 6.1CVE-2026-108925EPSS 0.2%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface:  versions before 11…

  26. 5.4CVE-2026-106139EPSS 0.1%

    In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared t…

  27. 5.4CVE-2026-106138EPSS 0.1%

    In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared toolt…

  28. 5.3CVE-2026-105829EPSS 0.2%

    League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a…

  29. 3.5CVE-2026-89290EPSS 0.2%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.

  30. 1.2CVE-2026-103585EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension:…

  31. 1.1CVE-2026-103584EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata ex…

  32. 1.2CVE-2026-103445EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1…

  33. 0.3CVE-2026-103439EPSS 0.1%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1…

  34. 0.3CVE-2026-103438EPSS 0.1%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension:…

  35. 1.1CVE-2026-103437EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1…

  36. 1.1CVE-2026-103444EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.

  37. 1.1CVE-2026-103443EPSS 0.2%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collectio…

  38. 2.7CVE-2026-27085EPSS 0.2%

    Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

  39. 3.1CVE-2026-102279EPSS 0.3%

    Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scri…

  40. 5.3CVE-2026-63216EPSS 0.2%

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the…

  41. 7.5CVE-2026-57440EPSS 0.3%

    The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not…

  42. 9.3CVE-2026-91130EPSS 0.5%

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and compute…

  43. 7.0CVE-2026-68919EPSS 0.5%

    GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage De…

  44. 7.5CVE-2026-52741EPSS 0.5%

    GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+…

  45. 5.4CVE-2026-12751EPSS 0.3%

    IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

  46. 4.3CVE-2026-54503EPSS 0.4%

    plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored R…

  47. 6.1CVE-2026-52774ExploitEPSS 0.7%

    YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can…

  48. 6.1CVE-2026-52773ExploitEPSS 0.6%

    YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerce…

  49. 6.1CVE-2026-32773EPSS 0.4%

    There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged…

  50. 6.4CVE-2026-82838EPSS 0.4%

    The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.