Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-94167HIGHWordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109895HIGHWordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94632HIGHWordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94159HIGHWordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-76303MEDIUMStored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAREPSS 0.2%CVE-2026-40732HIGHWordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42658HIGHWordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-45437HIGHWordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34725HIGHdbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configurationEPSS 0.2%CVE-2026-34800MEDIUMEndian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-62095HIGHWordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34805MEDIUMEndian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-39507HIGHWordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42711HIGHWordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42775HIGHWordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102385HIGHWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39778HIGHWordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39548HIGHWordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39780HIGHWordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-29840MEDIUMJiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserControllEPSS 0.2%