Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-108485HIGHWordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62091HIGHWordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62064HIGHWordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-38432MEDIUMERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to createEPSS 0.2%CVE-2026-42697HIGHWordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42702HIGHWordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62037HIGHWordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-95596HIGHWordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94661HIGHWordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40803HIGHWordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62100HIGHWordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1769MEDIUMStored XSS on Xerox CentreWare Web 7.0.6EPSS 0.2%CVE-2026-96816HIGHWordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97268HIGHWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94170HIGHWordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57702MEDIUMReflected Cross-site Scripting in DIAEnergieEPSS 0.2%CVE-2026-95609HIGHWordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39597HIGHWordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115277MEDIUMWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterEPSS 0.2%CVE-2026-30895MEDIUMJoomla! Core - [20260504] - XSS in readmore linksEPSS 0.2%