Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-6634MEDIUMMaster Currency WP <= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form ShortcodeEPSS 0.3%CVE-2026-1512MEDIUMEssential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box WidgetEPSS 0.3%CVE-2026-58028NONEPretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsEPSS 0.3%CVE-2025-5337MEDIUMSlider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label ParameterEPSS 0.3%CVE-2025-1526MEDIUMDethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23998HIGHWordPress UltraLight theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-102774MEDIUMSureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post ContentEPSS 0.3%CVE-2024-2163MEDIUMNinja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsEPSS 0.3%CVE-2025-10434MEDIUMIbuyuCMS Add Article article.php cross site scriptingEPSS 0.3%CVE-2025-46496MEDIUMWordPress Mini twitter feed plugin <= 3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46479MEDIUMWordPress BBCode Deluxe plugin <= 2020.08.01.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-51942MEDIUMStored XSS vulnerability in Rest Admin API under Hosted Feature Services pageEPSS 0.3%CVE-2025-23834HIGHWordPress Links/Problem Reporter plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22583HIGHWordPress Scan External Links Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23730HIGHWordPress FLX Dashboard Groups plugin <= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3716MEDIUMWavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scriptingEPSS 0.3%CVE-2024-34686MEDIUMCross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)EPSS 0.3%CVE-2024-10904MEDIUMStored XSS in Server Admin APIEPSS 0.3%CVE-2024-51944MEDIUMStored XSS in Rest Services DirectoryEPSS 0.3%CVE-2025-22498HIGHWordPress LucidLMS plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%