Weaknesses of type CWE-79

30,606 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-29106MEDIUMSuiteCRM has blind XSS in return_id parameterEPSS 0.2%CVE-2025-62097MEDIUMWordPress SEO Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69017MEDIUMWordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24361MEDIUMWordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68597MEDIUMWordPress Jobs for WordPress plugin <= 2.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62743MEDIUMWordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63020MEDIUMWordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68605MEDIUMWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68598MEDIUMWordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62094MEDIUMWordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62744MEDIUMWordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63005MEDIUMWordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68076MEDIUMWordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68070MEDIUMWordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68079MEDIUMWordPress Salient Shortcodes plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3106CRITICALMultiple vulnerabilities in TeampassEPSS 0.2%CVE-2025-69357MEDIUMWordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68499MEDIUMWordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66094MEDIUMWordPress Yada Wiki plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68080MEDIUMWordPress User Avatar - Reloaded plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%