Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56014HIGHWordPress Olivia Theme <= 0.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53812HIGHWordPress WP GeoNames plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14803MEDIUMNex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSSEPSS 0.3%CVE-2024-49278MEDIUMWordPress Omnipress plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18548HIGHGroundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' ParameterEPSS 0.3%CVE-2024-44029HIGHWordPress Viala theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51779HIGHWordPress Don't Break The Code plugin <= .3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51783HIGHWordPress Forms: 3rd-Party Post Again plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49309HIGHWordPress Digitally theme <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51784HIGHWordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45621MEDIUMThe Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a sEPSS 0.3%CVE-2025-46689MEDIUMVerverica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.EPSS 0.3%CVE-2024-51694HIGHWordPress Geotagged Media plugin <= 0.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2537MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript LibraryEPSS 0.3%CVE-2025-27412MEDIUMREDAXO allows Authenticated Reflected Cross Site Scripting - packages installationEPSS 0.3%CVE-2025-30600MEDIUMWordPress WP Hotjar plugin <= 0.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52470HIGHWordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-24778HIGHGhost vulnerable to XSS via malicious Portal preview linksEPSS 0.3%CVE-2026-58205HIGHGRR has a Reflected XSS issueEPSS 0.3%CVE-2024-51692HIGHWordPress Bing Search API Integration plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%