Falhas do tipo CWE-87
56 resultadosNeutralização inadequada de sintaxe alternativa de XSS
A aplicação tenta filtrar XSS bloqueando tags e atributos HTML conhecidos, mas falha contra variações alternativas de sintaxe (como espaços, tabulações, quebras de linha, entidades HTML ou protocolos alternativos). Um atacante usa essas formas alternativas para injetar código JavaScript que o filtro não reconhece.
Exemplo
Um filtro bloqueia '<script>' mas aceita '<script\n>' ou '<img src=x onerror\t=alert(1)>' ou '<img src="java	script:alert(1)">'. Cada variação contorna regras simplistas de sanitização.
Como mitigar
Use uma biblioteca consolidada de sanitização (DOMPurify, OWASP ESAPI) que normaliza a entrada antes de validar, e prefira sempre listar explicitamente o que é permitido (whitelist) em vez de bloquear variações conhecidas (blacklist).
CVE-2024-8505MEDIUMWordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label ParameterEPSS 0.4%CVE-2024-4459MEDIUMThemesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TitlesEPSS 0.3%CVE-2025-14732MEDIUMElementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIEPSS 0.3%CVE-2024-25640MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-webEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2024-3519MEDIUMMedia Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langEPSS 0.3%CVE-2024-2618MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2750MEDIUMExclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.3%CVE-2024-3162MEDIUMJeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via TestimonialEPSS 0.3%CVE-2026-55237HIGHAutoGPT SignUp Page has DOM-Based XSS and Open RedirectEPSS 0.3%CVE-2023-6446MEDIUMCalculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-50712MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-web EPSS 0.3%CVE-2026-22711MEDIUMStored XSS through system messages in WikiLoveEPSS 0.3%CVE-2025-62414MEDIUMbagisto - Cross Site Scripting (XSS) in Create New CustomerEPSS 0.3%CVE-2025-62415MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)EPSS 0.3%CVE-2025-62418MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)EPSS 0.3%CVE-2025-49137HIGHHax CMS Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2024-3666MEDIUMOpal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-42458MEDIUMMagento LTS: Reflected XSS - Import -> Data Flow (profiles)EPSS 0.3%