Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.2%CVE-2025-58254MEDIUMWordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53865MEDIUMIn Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).EPSS 0.2%CVE-2025-58253MEDIUMWordPress Real Estate Manager Plugin <= 7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-10716MEDIUMPega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.EPSS 0.2%CVE-2026-89100MEDIUMPayment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL FragmentEPSS 0.2%CVE-2026-110899HIGHWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59565MEDIUMWordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58229MEDIUMWordPress Sitekit Plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58248MEDIUMWordPress Pinterest Pinboard Widget Plugin <= 1.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58031MEDIUMWordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-105220HIGHTwine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story FilesEPSS 0.2%CVE-2026-105124MEDIUMW (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and CommentsEPSS 0.2%CVE-2025-8726MEDIUMWP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_uploadEPSS 0.2%CVE-2025-58653MEDIUMWordPress JSM file_get_contents() Shortcode Plugin <= 2.7.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58654MEDIUMWordPress xili-language Plugin <= 2.21.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-36697MEDIUMA cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrarEPSS 0.2%CVE-2025-12872MEDIUMaEnrich｜eHRD - Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-62854HIGHFreeScout: Stored XSS in mailbox signature via same-origin JS uploadEPSS 0.2%CVE-2025-58026MEDIUMWordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%