Weaknesses of type CWE-79

29,800 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-4336MEDIUMUltimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ ContentEPSS 0.4%CVE-2023-3560LOWGZ Scripts Ticket Booking Script load.php cross site scriptingEPSS 0.4%CVE-2025-23896MEDIUMWordPress Mindmeister Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23796MEDIUMWordPress Easy Portfolio plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-45665HIGHOpen WebUI: Stored XSS in Banner Component via Improper Sanitization OrderEPSS 0.4%CVE-2025-23890MEDIUMWordPress Easy Tweet Embed plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-22698MEDIUMWordPress Theme Blvd Responsive Google Maps Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24009MEDIUMWordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-56174HIGHIn Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under speciEPSS 0.4%CVE-2022-44575MEDIUMA vulnerability has been identified in PLM Help Server V4.2 (All versions). A reflected cross-site scripting (XSS) vulnerability exists in tEPSS 0.4%CVE-2022-41640MEDIUMWordPress Wholesale Suite Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11492MEDIUM115cms appurladd.html cross site scriptingEPSS 0.4%CVE-2025-12499HIGHRich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google ReviewEPSS 0.4%CVE-2025-23794MEDIUMWordPress wp_amaps Plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23868MEDIUMWordPress Chess Tempo Viewer plugin <= 0.9.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-7924MEDIUMPHPGurukul Online Banquet Booking System admin-profile.php cross site scriptingEPSS 0.4%CVE-2023-23892MEDIUMWordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-42485MEDIUMWordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23863MEDIUMWordPress Rollover Tab plugin <= 1.3.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-22712MEDIUMWordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%