Weaknesses of type CWE-79

30,207 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-1268MEDIUMDynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content FieldEPSS 0.3%CVE-2025-50866MEDIUMCloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic eEPSS 0.3%CVE-2026-3220HIGHMultiple Plugins - Unauthenticated Stored XSS via Minify LibraryEPSS 0.3%CVE-2024-1057MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-47367HIGHWordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13673MEDIUMBig Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9158HIGHXSSEPSS 0.3%CVE-2024-12205MEDIUMThemesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2273MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-38676MEDIUMWordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1364MEDIUMElementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-47394HIGHWordPress WP JobSearch plugin <= 2.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4996MEDIUMIntelbras RF 301K Add Static IP cross site scriptingEPSS 0.3%CVE-2024-9702MEDIUMSocial Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-2137MEDIUMAll-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing WidgetsEPSS 0.3%CVE-2024-30931MEDIUMStored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges viaEPSS 0.3%CVE-2026-110533MEDIUMFV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-32594MEDIUMWordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2616MEDIUMyangyouwang 杨有旺 crud 简约后台管理系统 Role Management Page cross site scriptingEPSS 0.3%CVE-2024-2079MEDIUMWPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%