Weaknesses of type CWE-79

30,593 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-25018HIGHWordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-7687MEDIUMAZIndex <= 0.8.1 - Stored XSS via CSRFEPSS 0.2%CVE-2026-25435HIGHWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-33082MEDIUMIBM Concert Software cross-site scriptingEPSS 0.2%CVE-2026-30894MEDIUMJoomla! Core - [20260503] - XSS in com_contenthistoryEPSS 0.2%CVE-2026-23979HIGHWordPress Gyan Elements plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57890MEDIUMWordPress Sessions Plugin <= 3.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-25452HIGHWordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-44064HIGHWordPress Like Button Rating LikeBtn plugin <= 2.6.53 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-25346HIGHWordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-22524HIGHWordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60179MEDIUMWordPress Click & Tweet Plugin <= 0.8.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-25347HIGHWordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60177MEDIUMWordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27088HIGHWordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58873MEDIUMWordPress Pushe Web Push Notification Plugin <= 0.5.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-22523HIGHWordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32517HIGHWordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-35571MEDIUMEmissary has Stored XSS via Navigation Template Link InjectionEPSS 0.2%CVE-2026-25373HIGHWordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%