Weaknesses of type CWE-79

30,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-93897MEDIUMGeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')EPSS 0.2%CVE-2025-59569MEDIUMWordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58840MEDIUMWordPress Custom Team Manager Plugin <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58812MEDIUMWordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58235MEDIUMWordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104735MEDIUMRSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>EPSS 0.2%CVE-2026-63147MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Uploaded File NameEPSS 0.2%CVE-2025-62255LOWSelf Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older uEPSS 0.2%CVE-2025-10023MEDIUMA user with elevated privileges can inject XSS in the Services Meta-services configuration pageEPSS 0.2%CVE-2025-60112MEDIUMWordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58793MEDIUMWordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58605MEDIUMWordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58602MEDIUMWordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58851MEDIUMWordPress Boxed Content Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58624MEDIUMWordPress Exchange Rates Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58610MEDIUMWordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48315MEDIUMWordPress WordPress HTML plugin <= 0.51 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58826MEDIUMWordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58242MEDIUMWordPress Bg Church Memos Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-96574MEDIUMUser Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' ParameterEPSS 0.2%