Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-73184HIGHWordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-19723HIGHSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share HandlerEPSS 0.3%CVE-2026-57769HIGHWordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28177HIGHWordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2506MEDIUMEM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'EPSS 0.3%CVE-2026-84848HIGHWordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57428HIGHWordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57427HIGHWordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57686HIGHWordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73375HIGHWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-79663MEDIUMEch0 before 4.7.3 Stored XSS via RSS feed tag namesEPSS 0.3%CVE-2025-42962MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation)EPSS 0.3%CVE-2026-33653MEDIUMUploady Vulnerable to Stored Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-66633HIGHWordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57314HIGHWordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52340MEDIUMWordPress Photographer Connections plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-93526HIGHWordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59516HIGHWordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65560HIGHWordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57368HIGHWordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%