Falhas do tipo CWE-79

30.302 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-82221HIGHWordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47598MEDIUMWordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-90887HIGHWordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28082HIGHWordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81770HIGHWordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57735HIGHWordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65437HIGHWordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65510HIGHWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57409HIGHWordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52344MEDIUMWordPress Provide Forex Signals plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57351HIGHWordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66584HIGHWordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28170HIGHWordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-94176HIGHWordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50033MEDIUMWordPress Fitness Park theme <= 1.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-66596HIGHWordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66597HIGHWordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73354HIGHWordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9029HIGHStored XSS in the Geomap panel tile-layer attributionEPSS 0.3%CVE-2026-56072HIGHWordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%