Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-84781MEDIUMWordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2367MEDIUMSecure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributeEPSS 0.2%CVE-2026-65522MEDIUMWordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66433MEDIUMWordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94168MEDIUMWordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13286MEDIUMSVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050EPSS 0.2%CVE-2026-57737MEDIUMWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-40745MEDIUMExtension - tassos.gr - Reflected Cross site scripting vulnerability in Convert Forms component for Joomla < 4.4.8EPSS 0.2%CVE-2025-66686MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges EPSS 0.2%CVE-2026-57402MEDIUMWordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66644MEDIUMWordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57365MEDIUMWordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1823MEDIUMConsensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode AttributeEPSS 0.2%CVE-2026-59513MEDIUMWordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28182MEDIUMWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57617MEDIUMWordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28178MEDIUMWordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57684MEDIUMWordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66646MEDIUMWordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-54865MEDIUMWordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%