Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-44010MEDIUMWordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57650MEDIUMWordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57373MEDIUMWordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48277MEDIUMWordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-30084MEDIUMExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for JoomlaEPSS 0.2%CVE-2024-55554MEDIUMIntrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.EPSS 0.2%CVE-2026-62111MEDIUMWordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-65448MEDIUMWordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48917MEDIUMEU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072EPSS 0.2%CVE-2026-66638MEDIUMWordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48341MEDIUMWordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-62715MEDIUMClipBucket v5: Stored XSS via Collection TagsEPSS 0.2%CVE-2026-57754MEDIUMWordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1045MEDIUMViet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' ParametersEPSS 0.2%CVE-2026-66639MEDIUMWordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-65473MEDIUMWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27537MEDIUMWordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66578MEDIUMWordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62138MEDIUMWordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-83562MEDIUMWordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%