CWE-82 · Cross-site Scripting
Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
9CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
9 CVEs with CWE-82 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-48042WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerabilitysupsystic · Contact Form by Supsystic · CVSS 9.1 · 2024-10-16 | 9.1 | 1.1% | 2024-10-16 |
| CVE-2024-52434WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerabilitysupsystic · Popup by Supsystic · CVSS 9.1 · 2024-11-18 | 9.1 | 1.1% | 2024-11-18 |
| CVE-2024-49271WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.121 - Remote Code Execution (RCE) vulnerabilityUnlimited Elements · Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 9.1 · 2024-10-16 | 9.1 | 1.1% | 2024-10-16 |
| CVE-2024-52427WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerabilityVollstart · Event Tickets with Ticket Scanner · CVSS 9.9 · 2024-11-18 | 9.9 | 0.7% | 2024-11-18 |
| CVE-2024-52393WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerabilityEric Teubert · Podlove Podcast Publisher · CVSS 9.1 · 2024-11-14 | 9.1 | 0.5% | 2024-11-14 |
| CVE-2026-56735Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammadzammad · zammad · CVSS 5.3 · 2026-09-25 | 5.3 | 0.4% | 2026-09-25 |
| CVE-2025-53194WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) VulnerabilityCrocoblock · JetEngine · CVSS 8.5 · 2025-08-20 | 8.5 | 0.4% | 2025-08-20 |
| CVE-2023-30963Stored XSS in Foundry Slate Query Dropdown menuPalantir · com.palantir.foundry:foundry-frontend · CVSS 5.4 · 2023-07-10 | 5.4 | 0.4% | 2023-07-10 |
| CVE-2023-54423OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG EditorOpenMage · magento-lts · CVSS 7.5 · 2026-11-13 | 7.5 | 0.2% | 2026-11-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.