Weaknesses of type CWE-79

30,281 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-24586HIGHWordPress Shipment Tracker for Woocommerce plugin <= 1.4.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50410MEDIUMWordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32670HIGHWordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32529HIGHWordPress iONE360 configurator plugin <= 2.0.57 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46234HIGHWordPress Control Listings plugin <= 1.0.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27292HIGHWordPress WPYog Documents Plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32532HIGHWordPress UXsniff plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10366MEDIUMMiczFlor RPi-Jukebox-RFID inc.setWlanIpMail.php cross site scriptingEPSS 0.3%CVE-2024-12623MEDIUMDICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32520HIGHWordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23769HIGHWordPress Content Mirror plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39432HIGHWordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerabilityEPSS 0.3%CVE-2024-13467MEDIUMWP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-14538MEDIUMyangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scriptingEPSS 0.3%CVE-2025-22692HIGHWordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50409MEDIUMWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32637HIGHWordPress WP Donate Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39519HIGHWordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46502HIGHWordPress LSD Custom taxonomy and category meta plugin <= 1.3.2 - CSRF to XSS vulnerabilityEPSS 0.3%CVE-2025-32622HIGHWordPress OTP-less one tap Sign in Plugin <= 2.0.58 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%