Weaknesses of type CWE-79

30,302 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-57728HIGHWordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66429HIGHWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-90986HIGHWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-88746HIGHidccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.EPSS 0.3%CVE-2026-57312HIGHWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57741HIGHWordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28175HIGHWordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57369HIGHWordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65517HIGHWordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-59746MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.3%CVE-2026-57399HIGHWordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69156HIGHWordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52346MEDIUMWordPress SimpleGMaps plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-45313MEDIUMA cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in EPSS 0.3%CVE-2026-61986HIGHWordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66598HIGHWordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-101921MEDIUMWPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc AttributeEPSS 0.3%CVE-2024-52339MEDIUMWordPress Mage Front End Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-78263HIGHWordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66612HIGHWordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%