Weaknesses of type CWE-79

30,147 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-51534MEDIUMWordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10049MEDIUMEdit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via pageEPSS 0.3%CVE-2024-27996MEDIUMWordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-24399CRITICALChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input ExecutionEPSS 0.3%CVE-2024-12393MEDIUMDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003EPSS 0.3%CVE-2024-30185MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30520MEDIUMWordPress Carousel Anything For WPBakery Page Builder plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9653MEDIUMRestaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-3888MEDIUMJupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVGEPSS 0.3%CVE-2024-11488MEDIUM115cms web_user.html cross site scriptingEPSS 0.3%CVE-2024-29927MEDIUMWordPress WishSuite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-7655MEDIUMCommunity by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-51685MEDIUMWordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-54011HIGHOpen WebUI: Stored XSS in Mermaid Markdown PreviewEPSS 0.3%CVE-2026-44482CRITICALsoundcloud-rpc: Remote Code Execution via XSS in Track TitleEPSS 0.3%CVE-2024-10555MEDIUMMaxButtons < 9.8.1 - Admin+ Stored XSS via Button WidthEPSS 0.3%CVE-2024-29925MEDIUMWordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29811MEDIUMWordPress Radio Player plugin <= 2.0.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34374MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45984MEDIUMA Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject maEPSS 0.3%