Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-37429MEDIUMWordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31598MEDIUMWordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin <= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5583MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget SettingsEPSS 0.3%CVE-2025-31592MEDIUMWordPress Send E-mail plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10310MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery WidgetEPSS 0.3%CVE-2024-4452MEDIUMElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-108920MEDIUMSourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scriptingEPSS 0.3%CVE-2026-120205HIGHThelia before 3.1.0 Stored XSS via Coupon Condition Customer NameEPSS 0.3%CVE-2024-9696MEDIUMRescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-4400MEDIUMPost and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-89241MEDIUMWWBN AVideo Reflected XSS via confirmLivePassword.phpEPSS 0.3%CVE-2024-56260MEDIUMWordPress ShopElement plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5086MEDIUMEssential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel WidgetEPSS 0.3%CVE-2024-5818MEDIUMRoyal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider WidgetEPSS 0.3%CVE-2024-25637LOWReflected XSS via X-October-Request-Handler HeaderEPSS 0.3%CVE-2026-100877MEDIUMmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scriptingEPSS 0.3%CVE-2025-1551MEDIUMIBM Operational Decision Manager cross-site scriptingEPSS 0.3%CVE-2024-9704MEDIUMSocial Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-89239MEDIUMWWBN AVideo Reflected XSS via Referer Header Comment BreakoutEPSS 0.3%CVE-2025-53493MEDIUMStored XSS in MintyDocsEPSS 0.3%