Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-59553HIGHWordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57733HIGHWordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66698HIGHWordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81795HIGHWordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66623HIGHWordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57734HIGHWordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66655HIGHWordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66604HIGHWordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-61573MEDIUMAVideo-Encoder: reflected cross-site scripting in the login interfaceEPSS 0.3%CVE-2026-65440HIGHWordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28158HIGHWordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57682HIGHWordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66690HIGHWordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-16570HIGHNextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth CallbackEPSS 0.3%CVE-2026-81765HIGHWordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-82224HIGHWordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51939MEDIUMWordPress Stylish Internal Links plugin <= 1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56043HIGHWordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63419MEDIUMCross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature EPSS 0.3%CVE-2026-57422HIGHWordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%