Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-39626MEDIUMWordPress Pretty Simple Popup Builder plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49292MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.7.1 - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2024-49264MEDIUMWordPress Events Addon for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31037HIGHWordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24771HIGHWordPress Content Manager Light plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9407MEDIUMmtons mblog profile cross site scriptingEPSS 0.3%CVE-2024-47622MEDIUMWordPress Advanced Woo Labels plugin <= 2.01 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51675MEDIUMWordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50052HIGHWordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-43324MEDIUMWordPress Clever Addons for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23889HIGHWordPress FooGallery Captions Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23888HIGHWordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35688MEDIUMWordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43961MEDIUMWordPress azurecurve Toggle Show/Hide plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43227MEDIUMWordPress BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47368MEDIUMWordPress Premium Blocks plugin <= 2.1.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12589MEDIUMFinale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown TimerEPSS 0.3%CVE-2024-47594MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (KMC)EPSS 0.3%CVE-2024-45278MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Commerce BackofficeEPSS 0.3%CVE-2024-34760MEDIUMWordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%