Weaknesses of type CWE-79

30,585 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-24550MEDIUMWordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24555MEDIUMWordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-112313HIGHWordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-84279HIGHFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print JobEPSS 0.2%CVE-2025-68977MEDIUMWordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67951MEDIUMWordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-100275MEDIUMIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possibleEPSS 0.2%CVE-2025-12371MEDIUMNari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12033MEDIUMSimple Banner <= 3.0.10 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-12914MEDIUMXSS in Akinsoft's QR MenuEPSS 0.2%CVE-2024-12972MEDIUMXSS in Akinsoft's OctoCloudEPSS 0.2%CVE-2026-84911LOWAI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119EPSS 0.2%CVE-2026-8870MEDIUMTeam Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-108494HIGHWordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103667MEDIUMGitea container registry stored XSS through blob media typeEPSS 0.2%CVE-2025-54747MEDIUMWordPress Templatera Plugin <= 2.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%CVE-2025-54746MEDIUMWordPress Shortcode Redirect Plugin <= 1.0.02 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54749MEDIUMWordPress JetProductGallery Plugin <= 2.2.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-90437HIGHGravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field ValuesEPSS 0.2%