Weaknesses of type CWE-79

30,600 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-24629MEDIUMWordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115953MEDIUMWordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-123464MEDIUMWordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-121784MEDIUMWordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59135MEDIUMWordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119524MEDIUMWordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110881MEDIUMWordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-122673MEDIUMWordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-65837MEDIUMPublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.EPSS 0.2%CVE-2026-66675MEDIUMWordPress Motors plugin <= 1.4.128 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115956MEDIUMWordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115950MEDIUMWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-28357MEDIUMNocoDB: Stored Cross-Site Scripting via Formula CellEPSS 0.2%CVE-2024-58318MEDIUMKentico Xperience <= 13.0.162 Rich Text Editor Stored XSSEPSS 0.2%CVE-2026-39737MEDIUMWordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115613MEDIUMWordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114708MEDIUMWordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69350MEDIUMWordPress Accordion plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-121763MEDIUMWordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49337MEDIUMWordPress Dashboard Beacon plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%