Weaknesses of type CWE-79

29,740 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-27627HIGHKarakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSSEPSS 0.4%CVE-2025-23964HIGHWordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23956HIGHWordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-10720HIGHStored Cross-site Scripting (XSS) in phpipam/phpipamEPSS 0.4%CVE-2024-5036MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-52161CRITICALScholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.EPSS 0.4%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.4%CVE-2024-13566MEDIUMWP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2025-23735HIGHWordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23592HIGHWordPress dForms plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23813HIGHWordPress Guten Free Options Plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23668HIGHWordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9777MEDIUMAshe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2025-25164HIGHWordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23731HIGHWordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26586HIGHWordPress Events Planner Plugin <= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25165HIGHWordPress Staff Directory Plugin: Company Directory Plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26563HIGHWordPress Rocket Mobile Plugin <= 0.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23833MEDIUMWordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23728HIGHWordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%