Weaknesses of type CWE-79

30,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-62039MEDIUMWordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97262MEDIUMWordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-27420MEDIUMWordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97294MEDIUMWordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108168MEDIUMWordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-108487MEDIUMWordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105884MEDIUMWordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-104393MEDIUMWordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97266MEDIUMWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-42410MEDIUMWordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-62110MEDIUMWordPress Rescue Shortcodes plugin <= 3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97298MEDIUMWordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105060MEDIUMWordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-104391MEDIUMWordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97292MEDIUMWordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-97288MEDIUMWordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-105882MEDIUMWordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-103343MEDIUMWordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-118560MEDIUMCommerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265EPSS 0.1%CVE-2026-3457HIGHStored XSS vulnerability in Sentinel ACCEPSS 0.1%