Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23722HIGHWordPress Mind3doM RyeBread Widgets plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24686HIGHWordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44049MEDIUMWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23835HIGHWordPress Legal + Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2352MEDIUMAutoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta ValueEPSS 0.3%CVE-2025-48276MEDIUMWordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-13779MEDIUMHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-36647MEDIUMA stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a craftEPSS 0.3%CVE-2024-49703MEDIUMWordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12228MEDIUMprojectworlds Expense Management System Users Page create cross site scriptingEPSS 0.3%CVE-2025-34261MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/EPSS 0.3%CVE-2025-14560HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-39660MEDIUMWordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6701MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.EPSS 0.3%CVE-2026-103999HIGHUltra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-35643MEDIUMWordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-48218MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id ParametersEPSS 0.3%CVE-2024-43292MEDIUMWordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6700MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.EPSS 0.3%CVE-2025-60314MEDIUMConfiguroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on theEPSS 0.3%