Weaknesses of type CWE-79

30,283 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13467MEDIUMWP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27293HIGHWordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11807MEDIUMNPS computy <= 2.8.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27289HIGHWordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32522HIGHWordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-35399HIGHWeGIA has Stored XSS in backup file namesEPSS 0.3%CVE-2025-6509MEDIUMseaswalker spring-analysis SimpleController.java echo cross site scriptingEPSS 0.3%CVE-2025-23531HIGHWordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32670HIGHWordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27309HIGHWordPress flickr-slideshow-wrapper Plugin <= 5.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27417MEDIUMWeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameterEPSS 0.3%CVE-2025-62659LOWThe CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectorsEPSS 0.3%CVE-2025-27314HIGHWordPress Kush Micro News Plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31006HIGHWordPress Activity Reactions For Buddypress plugin <= 1.0.22 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3809HIGHDebug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32527HIGHWordPress T&P Gallery Slider plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50409MEDIUMWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27499MEDIUMWeGIA has a stored Cross-Site Scripting (XSS) in 'processa_edicao_socio.php' via the 'socio_nome' parameterEPSS 0.3%CVE-2025-32514HIGHWordPress WooCommerce Estimate and Quote plugin <= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24621HIGHWordPress Arconix Shortcodes plugin <= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%