Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22628HIGHWordPress Filled In Plugin <= 1.9.2 - CSRF to Stored XSS vulnerabilityEPSS 0.2%CVE-2025-57989MEDIUMWordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58452LOWWeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'EPSS 0.2%CVE-2025-23687HIGHWordPress Woo Store Mode plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53223HIGHWordPress Theme Switcher Reloaded Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-57681MEDIUMThe WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users anEPSS 0.2%CVE-2026-61995HIGHWordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-10024MEDIUMTinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode AttributeEPSS 0.2%CVE-2025-31102HIGHWordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13748MEDIUMUltimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title ParameterEPSS 0.2%CVE-2025-23744HIGHWordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47610MEDIUMWordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-62031HIGHWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53224HIGHWordPress NextGEN Gallery Search Plugin <= 2.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-23845HIGHWordPress ImageMeta Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63544MEDIUMTechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.EPSS 0.2%CVE-2025-50976MEDIUMIPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME quEPSS 0.2%CVE-2026-0949MEDIUMPEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage ChEPSS 0.2%CVE-2025-49911HIGHWordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57967MEDIUMWordPress WPB Quick View for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%