Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-39437HIGHWordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103342HIGHWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-95595HIGHWordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-94063HIGHWordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97263HIGHWordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108498HIGHWordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103062HIGHWordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-100510HIGHWordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-87971HIGHIf-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' ParameterEPSS 0.1%CVE-2026-78532HIGHWordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-7958MEDIUMInappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-109702HIGHWordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97253HIGHWordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-102391HIGHWordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-54189HIGHWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42653HIGHWordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42681HIGHWordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-18117HIGHConcrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias NameEPSS 0.1%CVE-2026-54188HIGHWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-96332HIGHWordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%