Weaknesses of type CWE-79

30,302 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-82221HIGHWordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47598MEDIUMWordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-90887HIGHWordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28082HIGHWordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81770HIGHWordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57735HIGHWordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65437HIGHWordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65510HIGHWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57409HIGHWordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52344MEDIUMWordPress Provide Forex Signals plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57351HIGHWordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66584HIGHWordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28170HIGHWordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-94176HIGHWordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50033MEDIUMWordPress Fitness Park theme <= 1.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-66596HIGHWordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66597HIGHWordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73354HIGHWordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9029HIGHStored XSS in the Geomap panel tile-layer attributionEPSS 0.3%CVE-2026-56072HIGHWordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%