Weaknesses of type CWE-79

30,302 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-81776HIGHWordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28568HIGHWordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26895MEDIUMWordPress m1.DownloadList plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57767HIGHWordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69155HIGHWordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73393HIGHWordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3440MEDIUMIBM Security Guardium cross-site scriptingEPSS 0.3%CVE-2026-57370HIGHWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57421HIGHWordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81773HIGHWordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73190HIGHWordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69242MEDIUMReflected XSS in Raytha CMSEPSS 0.3%CVE-2026-57708HIGHWordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57398HIGHWordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65509HIGHWordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57383HIGHWordPress JobSearch plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28004HIGHWordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-65892MEDIUMReflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScriEPSS 0.3%CVE-2026-56045HIGHWordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66606HIGHWordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%