Weaknesses of type CWE-79

30,642 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3278HIGHXSS Vulnerability discovered in OpenText™ ZENworks Service Desk.EPSS 0.1%CVE-2026-115606HIGHWordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-94066HIGHWordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-112863HIGHWordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42685HIGHWordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-57639HIGHWordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-115609HIGHWordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-39744HIGHWordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-54851HIGHWordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-15654HIGHWordPress Prague plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-119477HIGHWordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-62007HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-9570HIGHTaskbuilder < 5.0.8 - Reflected XSS via ShortcodeEPSS 0.1%CVE-2026-119366HIGHWordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-52759HIGHWordPress Accordion FAQ plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-94060HIGHWordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-15643HIGHWordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-4816MEDIUMReflected Cross Site Scripting (XSS) vulnerability in Support BoardEPSS 0.1%CVE-2026-52702HIGHWordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103344HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%