Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13743MEDIUMWonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-44061HIGHWordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35631HIGHWordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48253MEDIUMWordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-53377LOWWebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameterEPSS 0.3%CVE-2025-63883MEDIUMA DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reaEPSS 0.3%CVE-2025-48488MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2025-27306MEDIUMWordPress Pathomation plugin <= 2.5.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54266MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-21872MEDIUMNiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linksEPSS 0.3%CVE-2024-39663HIGHWordPress WP Fast Total Search plugin <= 1.68.232 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44007HIGHWordPress SKT Templates – Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34553HIGHWordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13884MEDIUMHide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-13519MEDIUMMarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-47087MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47093MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-0555MEDIUMPremmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX EndpointEPSS 0.3%CVE-2025-28919MEDIUMWordPress Easy Image Display plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27265MEDIUMWordPress Google Maps for WordPress plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%