Weaknesses of type CWE-79

30,606 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-105890MEDIUMWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-8702MEDIUMGBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode AttributeEPSS 0.2%CVE-2026-64946HIGHCSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File ManagerEPSS 0.2%CVE-2026-96835MEDIUMWordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-105078MEDIUMWordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6252MEDIUMMeta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block AttributeEPSS 0.2%CVE-2026-104673MEDIUMWordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103084MEDIUMWordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109893MEDIUMWordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-100513MEDIUMWordPress CF7 Views &#8211; Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110375MEDIUMWordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104404MEDIUMWordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94665MEDIUMWordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110890MEDIUMWordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15636MEDIUMWordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-62078MEDIUMWordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94667MEDIUMWordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-105079MEDIUMWordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-108175MEDIUMWordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102914MEDIUMWordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%