Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-34180HIGHWordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49836MEDIUMWordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30867MEDIUMWordPress SearchIQ plugin <= 4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-5412MEDIUMMist Community Edition Authentication Endpoint views.py login cross site scriptingEPSS 0.4%CVE-2025-29094MEDIUMCross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the MEPSS 0.4%CVE-2023-33320HIGHWordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-28790MEDIUMWordPress Simple Staff List Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51213MEDIUMCross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php componentEPSS 0.4%CVE-2023-40007MEDIUMWordPress CT Commerce Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44986MEDIUMWordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41692HIGHWordPress Attorney Theme <= 3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-45007HIGHWordPress Fotomoto Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5212MEDIUMtagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]EPSS 0.4%CVE-2024-4895MEDIUMwpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV ImportEPSS 0.4%CVE-2024-9451MEDIUMEmbed PDF Viewer <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width ParametersEPSS 0.4%CVE-2024-37878MEDIUMCross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtimeEPSS 0.4%CVE-2025-30873MEDIUMWordPress Greenshift plugin <= 11.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1196MEDIUMcode-projects Real Estate Property Management System search.php cross site scriptingEPSS 0.4%CVE-2025-24578MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-34174HIGHWordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%