Weaknesses of type CWE-79

30,629 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-6170MEDIUMBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode AttributeEPSS 0.2%CVE-2026-6672MEDIUMAffiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url ShortcodeEPSS 0.2%CVE-2026-20915HIGHStored cross-site scripting in Pending Changes sidebarEPSS 0.2%CVE-2026-21825MEDIUMHCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search centerEPSS 0.2%CVE-2026-32528HIGHWordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-88826HIGHSmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbumsEPSS 0.2%CVE-2026-78068MEDIUMTable Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell ContentEPSS 0.2%CVE-2026-14882MEDIUMBrizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post MetaEPSS 0.2%CVE-2026-32542HIGHWordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-94421MEDIUMChurch Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' ParameterEPSS 0.2%CVE-2026-6171MEDIUMBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode AttributeEPSS 0.2%CVE-2026-88037MEDIUMBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service titleEPSS 0.2%CVE-2026-2868MEDIUMGutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'EPSS 0.2%CVE-2026-42759HIGHWordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32529HIGHWordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-93535MEDIUMWP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode AttributeEPSS 0.2%CVE-2026-42738HIGHWordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6172MEDIUMBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' ParameterEPSS 0.2%CVE-2026-78001MEDIUMPost and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' AttributeEPSS 0.2%CVE-2026-6173MEDIUMBold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' ParameterEPSS 0.2%