Weaknesses of type CWE-79

30,214 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-9702MEDIUMSocial Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-2308MEDIUMElementInvader Addons for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-0824MEDIUMExclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link AnythingEPSS 0.3%CVE-2024-2085MEDIUMHT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'EPSS 0.3%CVE-2024-38676MEDIUMWordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47341HIGHWordPress WP-DownloadManager plugin <= 1.68.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29004HIGHSolarWinds Platform Stored XSS VulnerabilityEPSS 0.3%CVE-2024-10453MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography SettingsEPSS 0.3%CVE-2024-47320HIGHWordPress WS Form LITE plugin <= 1.9.238 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3220HIGHMultiple Plugins - Unauthenticated Stored XSS via Minify LibraryEPSS 0.3%CVE-2023-52228MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13673MEDIUMBig Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-1426MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List WidgetEPSS 0.3%CVE-2024-32791MEDIUMWordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2079MEDIUMWPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-37960MEDIUMWordPress CodePen Embedded Pens Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2906MEDIUMContempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-31258MEDIUMWordPress Form to Chat App plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38678MEDIUMWordPress Calendar.online / Kalender.digital – Plugin plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2273MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%