Weaknesses of type CWE-79

29,750 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-25522MEDIUMCraft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.4%CVE-2024-11359MEDIUMLibrary Bookshelves <= 5.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-23731HIGHWordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-45814MEDIUMWordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23736HIGHWordPress Form To JSON plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25102HIGHWordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-22295HIGHWordPress Tripetto plugin <= 8.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23981MEDIUMWordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23673MEDIUMWordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23793MEDIUMWordPress Read More Without Refresh Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25972MEDIUMWordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-75981HIGHTranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-43874MEDIUMIBM App Connect Enterprise Certified ContainerEPSS 0.4%CVE-2024-9937MEDIUMWoo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-24386MEDIUMWordPress AI Contact Us Form Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23718MEDIUMWordPress Page Loading Effects Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44262MEDIUMWordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-94377HIGHVerified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)EPSS 0.4%CVE-2023-26528MEDIUMWordPress Shipyaari Shipping Management Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24387MEDIUMWordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%