Falhas do tipo CWE-79

30.303 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-66615HIGHWordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57360HIGHWordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69154HIGHWordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56051HIGHWordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12018MEDIUMMembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-7172MEDIUMStored Cross-Site Scripting (XSS) in TPVEnlanubeEPSS 0.3%CVE-2026-65492HIGHWordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81295HIGHWordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-81771HIGHWordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-20075MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-57674HIGHWordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66605HIGHWordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-93774HIGHWordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27605MEDIUMChartbrew: Stored Cross-Site Scripting (XSS) via File Upload APIEPSS 0.3%CVE-2026-57361HIGHWordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34577MEDIUMCross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing EPSS 0.3%CVE-2026-56039HIGHWordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65441HIGHWordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-56071HIGHWordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59556HIGHWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%