Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-57350HIGHWordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57706HIGHWordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32556HIGHWordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66663HIGHWordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32547HIGHWordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9720MEDIUMPortabilis i-Educar Cadastrar tabela de arredondamento edit cross site scriptingEPSS 0.3%CVE-2026-84820HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57715HIGHWordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59512HIGHWordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51931MEDIUMWordPress AzonBox plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66667HIGHWordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81775HIGHWordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66610HIGHWordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-61964HIGHWordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27536HIGHWordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57387HIGHWordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59558HIGHWordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73382HIGHWordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56006HIGHWordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-84793MEDIUMCraft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site nameEPSS 0.3%