Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-66433MEDIUMWordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-43484MEDIUMPoly Clariti Manager - Multiple Security VulnerabilitiesEPSS 0.2%CVE-2026-66645MEDIUMWordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40112MEDIUMPraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)EPSS 0.2%CVE-2025-68075MEDIUMWordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66643MEDIUMWordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-0812MEDIUMLinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PageEPSS 0.2%CVE-2026-73340MEDIUMWordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57330MEDIUMWordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57693MEDIUMWordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57684MEDIUMWordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66448MEDIUMWordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1805MEDIUMDA Media GigList <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode AttributeEPSS 0.2%CVE-2026-66646MEDIUMWordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57629MEDIUMWordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27431MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.2%CVE-2026-66577MEDIUMWordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57414MEDIUMWordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57783MEDIUMWordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-57402MEDIUMWordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%