Weaknesses of type CWE-79

29,740 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23619HIGHWordPress Catch Duplicate Switcher plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23509HIGHWordPress HyperComments plugin <= 0.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23741HIGHWordPress Notifications Center plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23498HIGHWordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-4669—Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via ShortcodeEPSS 0.4%CVE-2023-28820LOWConcrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element EPSS 0.4%CVE-2026-25484MEDIUMCraft Commerce has Stored XSS in Product Type NameEPSS 0.4%CVE-2025-23904HIGHWordPress Rebrand Fluent Forms Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-37272MEDIUMXSS vulnerability in JOC Cockpit branch 1.13EPSS 0.4%CVE-2025-25161HIGHWordPress WP Find Your Nearest Plugin <= 0.3.1 - CSRF to Settings Change vulnerabilityEPSS 0.4%CVE-2025-23740HIGHWordPress Easy School Registration plugin <= 3.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6334MEDIUM Easy Table of Contents < 2.0.67 - Editor+ Stored XSSEPSS 0.4%CVE-2025-23578HIGHWordPress Custom CSS Addons plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25169HIGHWordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23714HIGHWordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23721HIGHWordPress Mobigate plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26573HIGHWordPress Rizzi Guestbook plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23462HIGHWordPress FWD Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-10720HIGHStored Cross-site Scripting (XSS) in phpipam/phpipamEPSS 0.4%CVE-2025-0576MEDIUMMobotix M15 player cross site scriptingEPSS 0.4%