Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-66615HIGHWordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57360HIGHWordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69154HIGHWordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56051HIGHWordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12018MEDIUMMembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-7172MEDIUMStored Cross-Site Scripting (XSS) in TPVEnlanubeEPSS 0.3%CVE-2026-65492HIGHWordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81295HIGHWordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81771HIGHWordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-20075MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-57674HIGHWordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66605HIGHWordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-93774HIGHWordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27605MEDIUMChartbrew: Stored Cross-Site Scripting (XSS) via File Upload APIEPSS 0.3%CVE-2026-57361HIGHWordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34577MEDIUMCross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing EPSS 0.3%CVE-2026-56039HIGHWordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65441HIGHWordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56071HIGHWordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59556HIGHWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%