Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-48349MEDIUMWordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58683MEDIUMWordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-49397MEDIUMWordPress Colorbox Lightbox Plugin <= 1.1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58008MEDIUMWordPress Participants Database Plugin <= 2.7.6.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-7015MEDIUMMaxSite CMS Guestbook Plugin cross site scriptingEPSS 0.2%CVE-2026-7013MEDIUMMaxSite CMS mail_send Plugin cross site scriptingEPSS 0.2%CVE-2025-58703MEDIUMWordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-43746MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QEPSS 0.2%CVE-2025-57999MEDIUMWordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-57986MEDIUMWordPress WP Subtitle plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48347MEDIUMWordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2902MEDIUMWP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via CommentEPSS 0.2%CVE-2025-58702MEDIUMWordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58237MEDIUMWordPress LC Wizard plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58233MEDIUMWordPress SQL Chart Builder Plugin <= 2.3.7.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2015-20119MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.phpEPSS 0.2%CVE-2026-93878MEDIUMDiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX ActionEPSS 0.2%CVE-2025-61651NONEi18n XSS through Special:CheckUser CheckUser helperEPSS 0.2%CVE-2025-20289MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker EPSS 0.2%CVE-2025-58682MEDIUMWordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%