Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-61995HIGHWordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48159HIGHWordPress Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48098HIGHWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54056HIGHWordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-54855HIGHWordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60452MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download mEPSS 0.2%CVE-2026-11908MEDIUMTagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043EPSS 0.2%CVE-2025-23995HIGHWordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-96648MEDIUMData Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows ActionEPSS 0.2%CVE-2025-60448MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient valiEPSS 0.2%CVE-2025-26553HIGHWordPress Pre Order Addon for WooCommerce plugin<= 1.0.7 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-60781MEDIUMPHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter.EPSS 0.2%CVE-2025-24615HIGHWordPress Analytics Cat Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53324HIGHWordPress Gutenify Plugin <= 1.5.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22262MEDIUMWordPress Bonjour Bar plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54680MEDIUMWordPress Blogger Buzz Theme theme <= 1.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-27379MEDIUMStored Cross-Site Scripting in AES BOM ViewerEPSS 0.2%CVE-2026-44899MEDIUMMistune Image Directive CSS Injection VulnerabilityEPSS 0.2%CVE-2025-22276MEDIUMWordPress Related Post Shortcode Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-54298MEDIUMAstro: XSS via Unescaped Attribute Names in Spread PropsEPSS 0.2%