Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-44591MEDIUMWordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-43463MEDIUMWordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-5742MEDIUMUsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link SubstitutionEPSS 0.4%CVE-2026-15755MEDIUMOpen User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%CVE-2026-15446MEDIUMEWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post ContentEPSS 0.4%CVE-2024-4107MEDIUMElementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-6378MEDIUMMaxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST APIEPSS 0.4%CVE-2026-4657MEDIUMEasy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta FieldEPSS 0.4%CVE-2026-15145MEDIUMEssential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetEPSS 0.4%CVE-2024-1055MEDIUMPowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-85653MEDIUMContextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block ParameterEPSS 0.4%CVE-2026-15739MEDIUMRich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode AttributeEPSS 0.4%CVE-2022-40694MEDIUMWordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4803HIGHRoyal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metaEPSS 0.4%CVE-2024-11192MEDIUMSpotify Play Button for WordPress <= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton ShortcodeEPSS 0.4%CVE-2022-44736MEDIUMWordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11493MEDIUM115cms pageAE.html cross site scriptingEPSS 0.4%CVE-2026-5217HIGHOptimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor ParameterEPSS 0.4%CVE-2024-34436MEDIUMWordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-8791MEDIUMBooking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%