Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-45455MEDIUMWordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47626MEDIUMWordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47622MEDIUMWordPress Advanced Woo Labels plugin <= 2.01 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13504HIGHWordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48276MEDIUMWordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-3448MEDIUMXSS on SDMEPSS 0.3%CVE-2024-35688MEDIUMWordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13779MEDIUMHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-48679LOWStored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: AcroniEPSS 0.3%CVE-2025-49245HIGHWordPress Testimonials Showcase plugin <= 1.9.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24774HIGHWordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35757MEDIUMWordPress Easy Age Verify plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43961MEDIUMWordPress azurecurve Toggle Show/Hide plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47368MEDIUMWordPress Premium Blocks plugin <= 2.1.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23722HIGHWordPress Mind3doM RyeBread Widgets plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33536MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res pEPSS 0.3%CVE-2026-21873HIGHZero-click XSS in all NiceGUI apps which uses `ui.sub_pages`EPSS 0.3%CVE-2025-31037HIGHWordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43324MEDIUMWordPress Clever Addons for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47642MEDIUMWordPress Keap Official Opt-in Forms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%