Weaknesses of type CWE-79

30,523 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-27332HIGHWordPress Agrofood theme < 1.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31450MEDIUMWordPress Toggle Box plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-105630HIGHPlane: Stored XSS via SVG attachment served inline on the application origin (account takeover)EPSS 0.2%CVE-2026-38939MEDIUMCross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitivEPSS 0.2%CVE-2026-103974MEDIUMlichess.org: Stored HTML Injection via PGN Annotator Tag in StudiesEPSS 0.2%CVE-2025-69392HIGHWordPress iMoney plugin <= 0.36 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4225MEDIUMCMS Made Simple User Management listusers.php cross site scriptingEPSS 0.2%CVE-2025-31414MEDIUMWordPress Cost Calculator Builder plugin <= 3.2.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-30963MEDIUMWordPress JetSmartFilters plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68495HIGHWordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-113808HIGHStored XSS on SNS Enrollment PortalEPSS 0.2%CVE-2026-28103HIGHWordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-22357HIGHWordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28075HIGHWordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47975MEDIUMWordPress Plugin WP Learn Manager 1.1.2 Stored XSSEPSS 0.2%CVE-2026-12202MEDIUMIntelliants Subrion CMS Blocks Endpoint cross site scriptingEPSS 0.2%CVE-2026-28100HIGHWordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31412MEDIUMWordPress JetProductGallery plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69384HIGHWordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13469MEDIUMPricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%