Weaknesses of type CWE-79

30,213 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47379HIGHWordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32592MEDIUMWordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3490MEDIUMWP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item ShortcodeEPSS 0.3%CVE-2024-27991MEDIUMWordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49678HIGHWordPress js paper theme <= 2.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3245MEDIUMEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube BlockEPSS 0.3%CVE-2024-29908MEDIUMWordPress Co-marquage service-public.fr plugin <= 0.5.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46335HIGHMobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon UploadEPSS 0.3%CVE-2024-25919MEDIUMWordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1466MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauEPSS 0.3%CVE-2024-30197MEDIUMWordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1842MEDIUMWPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attributeEPSS 0.3%CVE-2024-12205MEDIUMThemesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1268MEDIUMDynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content FieldEPSS 0.3%CVE-2024-49283HIGHWordPress CURCY plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9158HIGHXSSEPSS 0.3%CVE-2024-32961MEDIUMWordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29089MEDIUMWordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-110533MEDIUMFV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-30557MEDIUMWordPress Aesop Story Engine plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%