Weaknesses of type CWE-79

30,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-24640HIGHWordPress Empty Tags Remover Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27338HIGHWordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32564HIGHWordPress Stop Registration Spam Plugin <= 1.24 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-54221MEDIUMReflected XSS in UBB.threadsEPSS 0.3%CVE-2026-26023MEDIUMClient‑side DOM XSS in the web chat app of Dify when using echartsEPSS 0.3%CVE-2025-24637HIGHWordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2440HIGHSurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22565HIGHWordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27333HIGHWordPress Protected wp-login Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27295HIGHWordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32513HIGHWordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22692HIGHWordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39464HIGHWordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32615HIGHWordPress Clinked Client Portal Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32611HIGHWordPress WooCommerce TBC Credit Card Payment Gateway (Free) Plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26746HIGHWordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32520HIGHWordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67231MEDIUMA reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context EPSS 0.3%CVE-2025-25957MEDIUMCross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.EPSS 0.3%CVE-2026-84477MEDIUMAVideo Stored XSS via Live Schedule Title DescriptionEPSS 0.3%