Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-23497LOWFrappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs PagesEPSS 0.2%CVE-2026-115957MEDIUMWordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120845MEDIUMWordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-118097MEDIUMWordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116396MEDIUMWordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48196MEDIUMWordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119370MEDIUMWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115951MEDIUMWordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62989MEDIUMWordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-115602MEDIUMWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97254MEDIUMWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120848MEDIUMWordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-122665MEDIUMWordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-44568MEDIUMOpen WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application OrderEPSS 0.2%CVE-2026-118094MEDIUMWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-116398MEDIUMWordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-118087MEDIUMWordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2466HIGHDukaPress <= 3.2.4 - Reflected XSSEPSS 0.2%CVE-2025-58195MEDIUMWordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58887MEDIUMWordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%