Weaknesses of type CWE-79

30,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-58858MEDIUMWordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58842MEDIUMWordPress Donation Forms WP by Givecloud Plugin <= 1.0.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-3878MEDIUMWP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'EPSS 0.2%CVE-2026-110664MEDIUMPremium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order NotesEPSS 0.2%CVE-2025-60147MEDIUMWordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-59553MEDIUMWordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58002MEDIUMWordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-104762MEDIUMKadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family AttributeEPSS 0.2%CVE-2025-58917MEDIUMWordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58620MEDIUMWordPress PDF for WPForms Plugin <= 6.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68504MEDIUMWordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57993MEDIUMWordPress Geolocation IP Detection plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-5567MEDIUMShortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' AttributeEPSS 0.2%CVE-2025-48316MEDIUMWordPress Responsive Mobile-Friendly Tooltip plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8461HIGHReflected XSS in Seres Software's syWEBEPSS 0.2%CVE-2025-60099MEDIUMWordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58850MEDIUMWordPress Showpass WordPress Extension Plugin <= 4.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58784MEDIUMWordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58808MEDIUMWordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-109512MEDIUMMang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' ParameterEPSS 0.2%