Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-105871MEDIUMWordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105875MEDIUMWordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-54867MEDIUMWordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-107865MEDIUMWordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-111405MEDIUMWordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-107866MEDIUMWordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-62049MEDIUMWordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-102798MEDIUMWordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103064MEDIUMWordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97265MEDIUMWordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-62029MEDIUMWordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-54870MEDIUMWordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-102394MEDIUMWordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-117533LOWREDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG UploadsEPSS 0.1%CVE-2026-62084MEDIUMWordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-110903MEDIUMWordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103063MEDIUMWordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105873MEDIUMWordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103339MEDIUMWordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105056MEDIUMWordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%