Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-119510MEDIUMWordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-15659MEDIUMWordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-81429HIGHExport & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRFEPSS 0.1%CVE-2026-111410MEDIUMWordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-116848MEDIUMWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-119521MEDIUMWordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-120843MEDIUMWordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-119489MEDIUMWordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-114706MEDIUMWordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42751MEDIUMWordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42750MEDIUMWordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-48821MEDIUMShaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail SynchronizerEPSS 0.1%CVE-2024-8528MEDIUMALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameterEPSS 0.1%CVE-2026-54869MEDIUMWordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-54868MEDIUMWordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-111400MEDIUMWordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-107864MEDIUMWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-64711LOWPrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for usersEPSS 0.1%CVE-2026-105069MEDIUMWordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42695MEDIUMWordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%