Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-61974HIGHWordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57671HIGHWordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-44089MEDIUMXSS in Visual ConsoleEPSS 0.3%CVE-2015-20116MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload FilenameEPSS 0.3%CVE-2025-65368MEDIUMSparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.EPSS 0.3%CVE-2026-66700HIGHWordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-53206MEDIUMWordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-82883HIGHWordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57668HIGHWordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66614HIGHWordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54032HIGHWordPress Real Estate Manager Pro Plugin <= 12.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-66440HIGHWordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7170MEDIUMStored Cross-Site Scripting (XSS) in TPVEnlanubeEPSS 0.3%CVE-2026-65438HIGHWordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-86772MEDIUMSnipe-IT 8.6.3 Stored XSS via Department NamesEPSS 0.3%CVE-2026-65447HIGHWordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57349HIGHWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52345MEDIUMWordPress ra_qrcode plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57338HIGHWordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57345HIGHWordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%