Weaknesses of type CWE-79

29,963 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-52461HIGHWordPress Infinite Slider plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52457HIGHWordPress Youneeq Recommendations plugin <= 3.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56025HIGHWordPress AdWork Media EZ Content Locker plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-4374MEDIUMDethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-31110HIGHWordPress Contact Form 7 Newsletter plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-13969MEDIUMReviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode AttributeEPSS 0.4%CVE-2025-24668MEDIUMWordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-10784MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-24700HIGHWordPress WP Editor plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-32275HIGHTautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theftEPSS 0.4%CVE-2024-31097HIGHWordPress SEO Title Tag plugin <= 3.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-7053MEDIUMCockpit save cross site scriptingEPSS 0.4%CVE-2024-54329HIGHWordPress CleverNode Related Content plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4088MEDIUMSwitch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-72747MEDIUMAVideo Stored Cross-Site Scripting via Unauthenticated RegistrationEPSS 0.4%CVE-2024-52465HIGHWordPress LGPD Framework plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-32510HIGHWordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12453MEDIUMUptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11889MEDIUMMy IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-44025MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.EPSS 0.4%