Weaknesses of type CWE-79

29,740 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23603HIGHWordPress Group category creator plugin <= 1.3.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23578HIGHWordPress Custom CSS Addons plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23866MEDIUMWordPress Interactive Geo Maps Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23753HIGHWordPress DN Sitemap Control plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-28865HIGHWordPress WP Colorful Tag Cloud plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2019-25408MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via netwizard2EPSS 0.4%CVE-2025-27267HIGHWordPress Random Quotes Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23852HIGHWordPress First Comment Redirect plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26575HIGHWordPress Display Post Meta plugin <= 1.5- Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24694HIGHWordPress CM Pop-Up Banners plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23495HIGHWordPress WooCommerce Order Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23619HIGHWordPress Catch Duplicate Switcher plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23503HIGHWordPress Customizable Captcha and Contact us plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23904HIGHWordPress Rebrand Fluent Forms Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25169HIGHWordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11348MEDIUMReflected XSS in Eura7 CMSmanagerEPSS 0.4%CVE-2025-23583HIGHWordPress Explara Membership plugin <= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23597HIGHWordPress Rio Photo Gallery plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23611HIGHWordPress WH Cache & Security plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-92973MEDIUMansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8EPSS 0.4%