Weaknesses of type CWE-79

30,094 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2688MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'EPSS 0.3%CVE-2024-2789MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via CalendyEPSS 0.3%CVE-2024-4481MEDIUMGutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block LinkEPSS 0.3%CVE-2024-2457MEDIUMModal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-1808MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode ShortcodeEPSS 0.3%CVE-2024-31104MEDIUMWordPress GetResponse for WordPress plugin <= 5.5.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2507MEDIUMJetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URLEPSS 0.3%CVE-2024-4158MEDIUMBlocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3989MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery JustifyEPSS 0.3%CVE-2024-38671MEDIUMWordPress WP GoToWebinar plugin <= 15.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6511MEDIUMy_project RuoYi Content-Type isJsonRequest cross site scriptingEPSS 0.3%CVE-2023-46194MEDIUMWordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-2841MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-0737MEDIUMShortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' ShortcodeEPSS 0.3%CVE-2023-25711MEDIUMWordPress WPGlobus Translate Options Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-1730MEDIUMPrime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-1054MEDIUMBooster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2121MEDIUMElementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-10074MEDIUMPortabilis i-Educar tipos cross site scriptingEPSS 0.3%CVE-2024-32723MEDIUMWordPress Advanced Floating Content plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%