Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-25300LOWsmartbanner.js rel noopener XSS vulnerabilityEPSS 0.4%CVE-2024-34445MEDIUMWordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-14433HIGHOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' ParameterEPSS 0.4%CVE-2026-14481MEDIUMEqualize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' ParameterEPSS 0.4%CVE-2024-11119MEDIUMBNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery ShortcodeEPSS 0.4%CVE-2024-28866LOWGoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-upEPSS 0.4%CVE-2023-47821MEDIUMWordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-47815MEDIUMCross-site Scripting in IncidentReportingEPSS 0.4%CVE-2026-15787MEDIUMUltimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon AttributesEPSS 0.4%CVE-2026-7796MEDIUMEmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' AttributeEPSS 0.4%CVE-2024-2535LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System users.php cross site scriptingEPSS 0.4%CVE-2023-2342MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.4%CVE-2024-30439HIGHWordPress Limit Attempts by BestWebSoft plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-3923MEDIUMBeaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-6176HIGHCustomer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review FormEPSS 0.4%CVE-2025-10032MEDIUMCampcodes Grocery Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2026-6640MEDIUMMedia Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes ParameterEPSS 0.4%CVE-2026-6378MEDIUMMaxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST APIEPSS 0.4%CVE-2022-40694MEDIUMWordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4657MEDIUMEasy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta FieldEPSS 0.4%