Weaknesses of type CWE-79

30,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-58836MEDIUMWordPress FW Anker Plugin <= 1.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-7713HIGHReflected XSS in Global Medya's PHP CMSEPSS 0.2%CVE-2025-57996MEDIUMWordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%CVE-2025-58621MEDIUMWordPress PuzzleMe for WordPress Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-47058LOWCross-site Scripting (XSS) - stored (edit form HTML field)EPSS 0.2%CVE-2025-58220MEDIUMWordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58605MEDIUMWordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58826MEDIUMWordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58602MEDIUMWordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-104735MEDIUMRSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>EPSS 0.2%CVE-2025-58235MEDIUMWordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-45318MEDIUMOpen WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)EPSS 0.2%CVE-2025-58691MEDIUMWordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-120648MEDIUMCGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS 0.2%CVE-2026-97723MEDIUMmadpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-coEPSS 0.2%CVE-2025-58812MEDIUMWordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-45585MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrEPSS 0.2%CVE-2025-8430MEDIUMA user with elevated privileges can inject XSS in the Commands Connectors configuration configuration pageEPSS 0.2%CVE-2026-24433MEDIUMTenda W30E V2 Stored XSS via Username FieldEPSS 0.2%