Weaknesses of type CWE-79

30,303 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-56040HIGHWordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66711HIGHWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66673HIGHWordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28187HIGHWordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66664HIGHWordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57319HIGHWordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65580HIGHWordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66599HIGHWordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57675HIGHWordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57415HIGHWordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50030MEDIUMWordPress Spark Multipurpose theme <= 1.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-73338HIGHWordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9722MEDIUMPortabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scriptingEPSS 0.3%CVE-2026-81300HIGHWordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66439HIGHWordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73378HIGHWordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-78293HIGHWordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-61944HIGHWordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66611HIGHWordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32333HIGHWordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%