Weaknesses of type CWE-79

30,465 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-54054MEDIUMWordPress 12 Step Meeting List Plugin <= 3.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4336MEDIUMUltimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ ContentEPSS 0.2%CVE-2026-6236MEDIUMPosts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode AttributeEPSS 0.2%CVE-2026-39040MEDIUMBharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpreEPSS 0.2%CVE-2025-59999MEDIUMJunos Space: API Access Profiles page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2026-48530MEDIUMGFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspxEPSS 0.2%CVE-2026-118783MEDIUMAll-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode AttributeEPSS 0.2%CVE-2025-11856MEDIUMEventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-49958HIGHWordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53286HIGHWordPress Dropify plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4279MEDIUMBread & Butter: Content Gating for Verified Leads <= 8.2.0.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-47570HIGHWordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-72821MEDIUMGrav Form Plugin before 9.1.15 Stored XSS via Radio ToggleEPSS 0.2%CVE-2026-61504MEDIUMRejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web ListingEPSS 0.2%CVE-2025-53225HIGHWordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53330MEDIUMWordPress WP Rentals theme <= 3.16.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54722HIGHWordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-37229MEDIUMWordPress Blogmentor – Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-52882MEDIUMAn issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devEPSS 0.2%CVE-2026-114711MEDIUMWordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%