Weaknesses of type CWE-79

30,207 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-32556MEDIUMWordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2839MEDIUMColibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-31258MEDIUMWordPress Form to Chat App plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49678HIGHWordPress js paper theme <= 2.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38696HIGHWordPress Zoho CRM Lead Magnet plugin <= 1.7.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2580MEDIUMWordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47379HIGHWordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30193MEDIUMWordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1842MEDIUMWPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attributeEPSS 0.3%CVE-2026-1466MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauEPSS 0.3%CVE-2024-29089MEDIUMWordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1421MEDIUMHT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel WidgetEPSS 0.3%CVE-2024-47349HIGHWordPress WPMobile.App plugin <= 11.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-44401MEDIUMTypemill CMS 2.x Persistent XSS via Markdown javascript URIEPSS 0.3%CVE-2026-30862CRITICALCritical Stored XSS & Privilege Escalation in AppsmithEPSS 0.3%CVE-2024-32536MEDIUMWordPress WP TradingView plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1426MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List WidgetEPSS 0.3%CVE-2024-27991MEDIUMWordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3245MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube BlockEPSS 0.3%CVE-2019-25277MEDIUMFaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.phpEPSS 0.3%