Weaknesses of type CWE-79

30,534 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-5567MEDIUMShortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' AttributeEPSS 0.2%CVE-2025-58850MEDIUMWordPress Showpass WordPress Extension Plugin <= 4.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-104762MEDIUMKadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family AttributeEPSS 0.2%CVE-2025-58917MEDIUMWordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58593MEDIUMWordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-60105MEDIUMWordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58028MEDIUMWordPress Designil PDPA Thailand plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58808MEDIUMWordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58002MEDIUMWordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-24433MEDIUMTenda W30E V2 Stored XSS via Username FieldEPSS 0.2%CVE-2025-14347MEDIUMReflected XSS in Proliz's OBSEPSS 0.2%CVE-2025-58858MEDIUMWordPress WPB Image Widget Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-68504MEDIUMWordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97338MEDIUMDownload Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display NameEPSS 0.2%CVE-2025-58607MEDIUMWordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-57576MEDIUMPHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php.EPSS 0.2%CVE-2025-58609MEDIUMWordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-110664MEDIUMPremium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order NotesEPSS 0.2%CVE-2025-45585MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrEPSS 0.2%CVE-2026-109512MEDIUMMang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' ParameterEPSS 0.2%