Weaknesses of type CWE-79

30,221 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-30579HIGHWordPress Pesapal Gateway for Woocommerce plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24836MEDIUMWordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-1795MEDIUMAddress Bar Ads <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-24839MEDIUMWordPress Structured Content Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-24804MEDIUMWordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-38360MEDIUMIBM CICS TX cross-site scriptingEPSS 0.3%CVE-2025-53936MEDIUMWeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `nome_car`EPSS 0.3%CVE-2025-53935MEDIUMWeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `id`EPSS 0.3%CVE-2025-30917HIGHWordPress SKU Generator for WooCommerce plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-24880MEDIUMWordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-30177MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30614HIGHWordPress Google Font Fix plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22150MEDIUMWordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-111967MEDIUMMP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode AttributeEPSS 0.3%CVE-2025-9910LOWVersions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker caEPSS 0.3%CVE-2025-30559HIGHWordPress Kento WordPress Stats plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53797MEDIUMWordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30547HIGHWordPress WP Cards plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11900MEDIUMPortfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-25934MEDIUMWordPress FormFacade plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%